Malware Analysis Report

2024-10-16 05:11

Sample ID 230923-18wjaacd85
Target 31e3172965034d615829287e98391877efd324bd0a9629915e730138f84419a8
SHA256 31e3172965034d615829287e98391877efd324bd0a9629915e730138f84419a8
Tags
amadey ammyyadmin flawedammyy healer phemedrone phobos redline rhadamanthys smokeloader nanya backdoor bootkit collection dropper evasion infostealer persistence ransomware rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

31e3172965034d615829287e98391877efd324bd0a9629915e730138f84419a8

Threat Level: Known bad

The file 31e3172965034d615829287e98391877efd324bd0a9629915e730138f84419a8 was found to be: Known bad.

Malicious Activity Summary

amadey ammyyadmin flawedammyy healer phemedrone phobos redline rhadamanthys smokeloader nanya backdoor bootkit collection dropper evasion infostealer persistence ransomware rat spyware stealer trojan

Healer

Rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

RedLine

Phobos

Ammyy Admin

RedLine payload

Amadey

Phemedrone

Modifies Windows Defender Real-time Protection settings

AmmyyAdmin payload

SmokeLoader

FlawedAmmyy RAT

Detects Healer an antivirus disabler dropper

Detect rhadamanthys stealer shellcode

Deletes shadow copies

Modifies boot configuration data using bcdedit

Renames multiple (470) files with added filename extension

Deletes backup catalog

Modifies Windows Firewall

Downloads MZ/PE file

Reads user/profile data of web browsers

Executes dropped EXE

Drops startup file

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Accesses Microsoft Outlook profiles

Drops desktop.ini file(s)

Looks up external IP address via web service

Writes to the Master Boot Record (MBR)

Suspicious use of SetThreadContext

Drops file in Program Files directory

Program crash

Unsigned PE

Enumerates physical storage devices

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

outlook_win_path

Suspicious behavior: MapViewOfSection

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

Checks processor information in registry

Interacts with shadow copies

Suspicious use of FindShellTrayWindow

Modifies registry class

outlook_office_path

Creates scheduled task(s)

Suspicious behavior: GetForegroundWindowSpam

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-09-23 22:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-23 22:19

Reported

2023-09-23 22:22

Platform

win10v2004-20230915-en

Max time kernel

150s

Max time network

155s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A

FlawedAmmyy RAT

trojan flawedammyy

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Phemedrone

stealer phemedrone

Phobos

ransomware phobos

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4704 created 3196 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (470) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4284382.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8937903.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\A3FF.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9FD8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\EBA3.tmp\svchost.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8248323.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0475414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9219702.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9794020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4284382.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8937903.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8618455.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9892.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9A29.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9892.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9E41.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9FD8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\A3FF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AFC8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Ynigope.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Ynigope.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EBA3.tmp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9A29.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SYSTEM32\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\31e3172965034d615829287e98391877efd324bd0a9629915e730138f84419a8.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8248323.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0475414.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9219702.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9794020.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NSzC8pOj = "C:\\Users\\Admin\\AppData\\Local\\NSzC8pOj.exe" C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NSzC8pOj = "C:\\Users\\Admin\\AppData\\Local\\NSzC8pOj.exe" C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-919254492-3979293997-764407192-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-919254492-3979293997-764407192-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\EBA3.tmp\svchost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 428 set thread context of 5040 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1928 set thread context of 1568 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3064 set thread context of 2376 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4584 set thread context of 4704 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe
PID 3080 set thread context of 3824 N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe
PID 3372 set thread context of 2224 N/A C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe
PID 1324 set thread context of 1516 N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe
PID 4324 set thread context of 3988 N/A C:\Users\Admin\AppData\Local\Temp\9892.exe C:\Users\Admin\AppData\Local\Temp\9892.exe
PID 852 set thread context of 1784 N/A C:\Users\Admin\AppData\Local\Temp\9E41.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
PID 1708 set thread context of 4324 N/A C:\Users\Admin\AppData\Local\Temp\9FD8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
PID 4452 set thread context of 1920 N/A C:\Users\Admin\AppData\Local\Temp\A3FF.exe C:\Windows\SysWOW64\explorer.exe
PID 4608 set thread context of 2756 N/A C:\Users\Admin\AppData\Local\Temp\9A29.exe C:\Users\Admin\AppData\Local\Temp\9A29.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\is.txt.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected][6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupLargeTile.scale-125.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreMedTile.scale-200.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\ui-strings.js.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\check-mark-2x.png.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\THMBNAIL.PNG.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\System\MSCOMCTL.OCX.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-US\en-US_female_TTS\skin_en-US_female_TTS.lua C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsSmallTile.scale-125.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\jscripts\wefgallery_strings.js C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\7734_32x32x32.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionWideTile.scale-100.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\sv.pak.DATA.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubStoreLogo.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\UserControls\SpeedSelectionSlider.xbf C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-xstate-l2-1-0.dll C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-72_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\ui-strings.js.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_SplashScreen.scale-200.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Microsoft.People.Relevance.QueryClient.winmd C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-tool-view.js C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\classlist C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-string-l1-1-0.dll C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libreal_plugin.dll.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\share_icons.png.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\82.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageMedTile.scale-400.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\mi.pak C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\SmallTile.scale-125.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\LAYERS.INF C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Resources\GetSMDL2.ttf C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\warning.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\ui-strings.js C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyShare-Dark.scale-125.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-256.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-200.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-40.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\MedTile.scale-100.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms.id[6E673161-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SplashScreen.scale-200.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-16_contrast-black.png C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9892.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9E41.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9FD8.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9A29.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\A3FF.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AFC8.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\EBA3.tmp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2860 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\31e3172965034d615829287e98391877efd324bd0a9629915e730138f84419a8.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8248323.exe
PID 2860 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\31e3172965034d615829287e98391877efd324bd0a9629915e730138f84419a8.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8248323.exe
PID 2860 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\31e3172965034d615829287e98391877efd324bd0a9629915e730138f84419a8.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8248323.exe
PID 3852 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8248323.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0475414.exe
PID 3852 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8248323.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0475414.exe
PID 3852 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8248323.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0475414.exe
PID 4984 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0475414.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9219702.exe
PID 4984 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0475414.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9219702.exe
PID 4984 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0475414.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9219702.exe
PID 2212 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9219702.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9794020.exe
PID 2212 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9219702.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9794020.exe
PID 2212 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9219702.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9794020.exe
PID 4536 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9794020.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe
PID 4536 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9794020.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe
PID 4536 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9794020.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe
PID 428 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 428 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 428 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 428 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 428 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 428 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 428 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 428 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 428 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 428 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 428 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 428 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 428 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 428 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4536 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9794020.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe
PID 4536 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9794020.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe
PID 4536 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9794020.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe
PID 1928 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1928 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1928 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1928 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1928 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1928 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1928 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1928 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1928 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1928 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2212 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9219702.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe
PID 2212 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9219702.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe
PID 2212 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9219702.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe
PID 3064 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3064 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3064 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3064 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3064 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3064 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3064 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3064 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3064 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3064 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3064 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4984 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0475414.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4284382.exe
PID 4984 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0475414.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4284382.exe
PID 4984 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0475414.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4284382.exe
PID 3692 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4284382.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
PID 3692 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4284382.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
PID 3692 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4284382.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
PID 3852 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8248323.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8937903.exe
PID 3852 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8248323.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8937903.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\31e3172965034d615829287e98391877efd324bd0a9629915e730138f84419a8.exe

"C:\Users\Admin\AppData\Local\Temp\31e3172965034d615829287e98391877efd324bd0a9629915e730138f84419a8.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8248323.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8248323.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0475414.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0475414.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9219702.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9219702.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9794020.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9794020.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 428 -ip 428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 428 -s 592

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1928 -ip 1928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1568 -ip 1568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 580

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 540

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3064 -ip 3064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 572

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4284382.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4284382.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8937903.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8937903.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explonde.exe" /P "Admin:N"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8618455.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8618455.exe

C:\Windows\SysWOW64\cacls.exe

CACLS "explonde.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legota.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "legota.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\cb378487cf" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\cb378487cf" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

"C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe"

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe

"C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe"

C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe

C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe

C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe

C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe

C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe

"C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe"

C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe

"C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe"

C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe

C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

C:\Users\Admin\AppData\Local\Temp\9892.exe

C:\Users\Admin\AppData\Local\Temp\9892.exe

C:\Users\Admin\AppData\Local\Temp\9A29.exe

C:\Users\Admin\AppData\Local\Temp\9A29.exe

C:\Users\Admin\AppData\Local\Temp\9892.exe

C:\Users\Admin\AppData\Local\Temp\9892.exe

C:\Users\Admin\AppData\Local\Temp\9E41.exe

C:\Users\Admin\AppData\Local\Temp\9E41.exe

C:\Users\Admin\AppData\Local\Temp\9FD8.exe

C:\Users\Admin\AppData\Local\Temp\9FD8.exe

C:\Users\Admin\AppData\Local\Temp\A3FF.exe

C:\Users\Admin\AppData\Local\Temp\A3FF.exe

C:\Users\Admin\AppData\Local\Temp\AFC8.exe

C:\Users\Admin\AppData\Local\Temp\AFC8.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\Ynigope.exe

"C:\Users\Admin\AppData\Local\Temp\Ynigope.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\Ynigope.exe

"C:\Users\Admin\AppData\Local\Temp\Ynigope.exe"

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1784 -ip 1784

C:\Users\Admin\AppData\Local\Temp\9A29.exe

"C:\Users\Admin\AppData\Local\Temp\9A29.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3024 -ip 3024

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 2160

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 1944

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3024 -ip 3024

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 1944

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Users\Admin\AppData\Local\Temp\EBA3.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\EBA3.tmp\svchost.exe -debug

C:\Windows\SYSTEM32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\EBA3.tmp\aa_nts.dll",run

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 39.142.81.104.in-addr.arpa udp
FI 77.91.124.82:19071 tcp
FI 77.91.68.52:80 77.91.68.52 tcp
FI 77.91.68.78:80 77.91.68.78 tcp
US 8.8.8.8:53 amx385.xyz udp
DE 45.89.127.193:80 amx385.xyz tcp
US 8.8.8.8:53 52.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 78.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 193.127.89.45.in-addr.arpa udp
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 61.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 254.178.238.8.in-addr.arpa udp
FI 77.91.124.82:19071 tcp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
FI 77.91.68.52:80 77.91.68.52 tcp
FI 77.91.68.78:80 77.91.68.78 tcp
FI 77.91.124.82:19071 tcp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 mksad917.xyz udp
DE 193.31.28.70:80 mksad917.xyz tcp
US 8.8.8.8:53 120.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 70.28.31.193.in-addr.arpa udp
US 8.8.8.8:53 cdn1.frocdn.ch udp
US 188.114.96.0:443 cdn1.frocdn.ch tcp
US 8.8.8.8:53 0.96.114.188.in-addr.arpa udp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 qu.ax udp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
US 8.8.8.8:53 136.72.226.91.in-addr.arpa udp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
IL 91.226.72.136:443 qu.ax tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
FI 77.91.124.82:19071 tcp
N/A 127.0.0.1:3051 tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.242:443 tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 148.129.42.188.in-addr.arpa udp
US 8.8.8.8:53 242.104.243.136.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 www.ammyy.com udp
DE 136.243.18.118:80 www.ammyy.com tcp
DE 136.243.18.118:443 www.ammyy.com tcp
US 8.8.8.8:53 118.18.243.136.in-addr.arpa udp
US 8.8.8.8:53 147.174.42.23.in-addr.arpa udp
US 8.8.8.8:53 176.25.221.88.in-addr.arpa udp
FI 77.91.124.82:19071 tcp
US 8.8.8.8:53 224.162.46.104.in-addr.arpa udp
FI 77.91.124.82:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8248323.exe

MD5 563dae20b8fc076d308963b74e8a3098
SHA1 1873aa1e894e41bd66c3dfb422cd518c3b647981
SHA256 ce11c55c6c6b7db8a4da4130ba02a57689cd6493d701fafdf3e73113fae54f97
SHA512 db6de0844074ac7144ec40b95b96a813551ac0d1030ab8b258cf836168a57b49c098454078c14b6a689855286bdf561700d9a5501d250030d5b03f55a427c7e2

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8248323.exe

MD5 563dae20b8fc076d308963b74e8a3098
SHA1 1873aa1e894e41bd66c3dfb422cd518c3b647981
SHA256 ce11c55c6c6b7db8a4da4130ba02a57689cd6493d701fafdf3e73113fae54f97
SHA512 db6de0844074ac7144ec40b95b96a813551ac0d1030ab8b258cf836168a57b49c098454078c14b6a689855286bdf561700d9a5501d250030d5b03f55a427c7e2

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0475414.exe

MD5 ffb4c3c0182566c4b47a801aead179e1
SHA1 6a667a9b27627ef1a695fc502685d304f764eaab
SHA256 a05483d1cecad8e2547150d84e698ee60acc015cfb61cd7b6763cdd9df85b900
SHA512 63f946fdfdc3c43b9a9b70a256504d5f98a36f835268c5922d708dc7aac1a90cf1c499f61cff7af0ddd26c44ca4765f82b73920ee7e562b6cf9e150457e46687

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0475414.exe

MD5 ffb4c3c0182566c4b47a801aead179e1
SHA1 6a667a9b27627ef1a695fc502685d304f764eaab
SHA256 a05483d1cecad8e2547150d84e698ee60acc015cfb61cd7b6763cdd9df85b900
SHA512 63f946fdfdc3c43b9a9b70a256504d5f98a36f835268c5922d708dc7aac1a90cf1c499f61cff7af0ddd26c44ca4765f82b73920ee7e562b6cf9e150457e46687

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9219702.exe

MD5 10024cffeac17ecd9869f91020910eee
SHA1 cb7acb4aa8b63226cdd7a807bcb7cd307a34df72
SHA256 209f1bda5251dfdb44754b65513a7ffaca72cdd1996b8ecb0f363834036d655c
SHA512 74c9193daadf7a1046e7a4f43e867f87d356e1fa10bf42ba60f7a1751981ff5c203174e45cfa50518d9f4387376ee8bd8f0138d99aadb27bbf84ab137e954c16

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9219702.exe

MD5 10024cffeac17ecd9869f91020910eee
SHA1 cb7acb4aa8b63226cdd7a807bcb7cd307a34df72
SHA256 209f1bda5251dfdb44754b65513a7ffaca72cdd1996b8ecb0f363834036d655c
SHA512 74c9193daadf7a1046e7a4f43e867f87d356e1fa10bf42ba60f7a1751981ff5c203174e45cfa50518d9f4387376ee8bd8f0138d99aadb27bbf84ab137e954c16

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9794020.exe

MD5 3685e6bb89cfae30540f526de5bb0936
SHA1 44fb39d87d5c8c9ad6ffcf06cb1a325caf72da76
SHA256 9d3bb0b3dc5678a4bbdde3127f6a61b270a3c0b2b7c783a7a74dbaf3834c7a80
SHA512 fe59151f49e401399dbe81d52e18cef3574356ca06fa231f459a04d661dd1f654f1c5441868725b56edc7c192d6a57b3cff655046755d50fec8cf16c80e513a3

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9794020.exe

MD5 3685e6bb89cfae30540f526de5bb0936
SHA1 44fb39d87d5c8c9ad6ffcf06cb1a325caf72da76
SHA256 9d3bb0b3dc5678a4bbdde3127f6a61b270a3c0b2b7c783a7a74dbaf3834c7a80
SHA512 fe59151f49e401399dbe81d52e18cef3574356ca06fa231f459a04d661dd1f654f1c5441868725b56edc7c192d6a57b3cff655046755d50fec8cf16c80e513a3

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe

MD5 0c3ff9de2fd0c1061c4f5382d679fbf9
SHA1 b34daae64a5477fae5d170e136194918d46e982c
SHA256 a1863fb82b4e6ae741bd277c07e9f52eff07bff33f03b26608f57f9138da91a9
SHA512 8ae0801dbee76e95a83b9c795980b85ff36cac713a0784df8a130b1a8c35bcf89a17c1811f39bc9f072e9413b5848b72bf10d17a0f1f155cfa2f100a8307fcc1

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6221924.exe

MD5 0c3ff9de2fd0c1061c4f5382d679fbf9
SHA1 b34daae64a5477fae5d170e136194918d46e982c
SHA256 a1863fb82b4e6ae741bd277c07e9f52eff07bff33f03b26608f57f9138da91a9
SHA512 8ae0801dbee76e95a83b9c795980b85ff36cac713a0784df8a130b1a8c35bcf89a17c1811f39bc9f072e9413b5848b72bf10d17a0f1f155cfa2f100a8307fcc1

memory/5040-35-0x0000000000400000-0x000000000040A000-memory.dmp

memory/5040-36-0x0000000074050000-0x0000000074800000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe

MD5 4fc14d3ebd4905bba5063ff223073077
SHA1 a73e46e6b7fc4791e0f2316a12c0f1843e767e17
SHA256 bda9f0a2a4d6496e5d78fd182a78090d5d5e04906f57d299c7594a63a24ba689
SHA512 504d1ebfcbd1baf0ec4eff206d1391f9aab0901a9fe0744a8157b5426ff9d0d0084e7cb0c53bfea640bdd476a55a77af9eb59c0a4e3d7a0ec774a9d6650fb194

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3752745.exe

MD5 4fc14d3ebd4905bba5063ff223073077
SHA1 a73e46e6b7fc4791e0f2316a12c0f1843e767e17
SHA256 bda9f0a2a4d6496e5d78fd182a78090d5d5e04906f57d299c7594a63a24ba689
SHA512 504d1ebfcbd1baf0ec4eff206d1391f9aab0901a9fe0744a8157b5426ff9d0d0084e7cb0c53bfea640bdd476a55a77af9eb59c0a4e3d7a0ec774a9d6650fb194

memory/1568-40-0x0000000000400000-0x000000000042C000-memory.dmp

memory/1568-41-0x0000000000400000-0x000000000042C000-memory.dmp

memory/1568-42-0x0000000000400000-0x000000000042C000-memory.dmp

memory/1568-44-0x0000000000400000-0x000000000042C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe

MD5 afea6eee0b375b59da4e7569702126af
SHA1 86da455600ed7f2be11750d2f91f5ad905ce3af7
SHA256 2bac8c95a45fbd4a30bb334fc8cbd265d5bf1fd564ac57aaa6e4a54cdc6a04fb
SHA512 dfaf887a15722308511c7f6a0161fa884b4afc007530d756014de708853f48c8fcde3ec8b440c9d307b325c41d57c1e3ed16513eecfa31d615c9e966e4a78cfc

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1106700.exe

MD5 afea6eee0b375b59da4e7569702126af
SHA1 86da455600ed7f2be11750d2f91f5ad905ce3af7
SHA256 2bac8c95a45fbd4a30bb334fc8cbd265d5bf1fd564ac57aaa6e4a54cdc6a04fb
SHA512 dfaf887a15722308511c7f6a0161fa884b4afc007530d756014de708853f48c8fcde3ec8b440c9d307b325c41d57c1e3ed16513eecfa31d615c9e966e4a78cfc

memory/2376-48-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2376-49-0x0000000002730000-0x0000000002736000-memory.dmp

memory/2376-50-0x0000000074050000-0x0000000074800000-memory.dmp

memory/2376-51-0x00000000055F0000-0x0000000005C08000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4284382.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

memory/2376-55-0x00000000050E0000-0x00000000051EA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4284382.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

memory/2376-56-0x0000000005020000-0x0000000005032000-memory.dmp

memory/2376-57-0x0000000002740000-0x0000000002750000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

memory/2376-60-0x0000000005080000-0x00000000050BC000-memory.dmp

memory/2376-65-0x00000000051F0000-0x000000000523C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8937903.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8937903.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

memory/5040-81-0x0000000074050000-0x0000000074800000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8618455.exe

MD5 c24cfaa5bc1547b2d5cbc80a1d02f039
SHA1 b67e7b3b6217ba14060ecadc0ff8bbdfbc15abfa
SHA256 7271f222404dc67edc86ae385eac8383aa65036658bb91a1e94d5a8b8bfe4522
SHA512 3eb67f40251e4dbd5354b3e2a680224af21abec139438b1fbcce6b61713d28fbc911ed9af462d0783f79702cf04d31c00a607e9e507f02a1d6ad975b55440f9e

memory/5040-86-0x0000000074050000-0x0000000074800000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8618455.exe

MD5 c24cfaa5bc1547b2d5cbc80a1d02f039
SHA1 b67e7b3b6217ba14060ecadc0ff8bbdfbc15abfa
SHA256 7271f222404dc67edc86ae385eac8383aa65036658bb91a1e94d5a8b8bfe4522
SHA512 3eb67f40251e4dbd5354b3e2a680224af21abec139438b1fbcce6b61713d28fbc911ed9af462d0783f79702cf04d31c00a607e9e507f02a1d6ad975b55440f9e

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

memory/4584-103-0x0000000000610000-0x00000000007F6000-memory.dmp

memory/4584-104-0x0000000074050000-0x0000000074800000-memory.dmp

memory/4584-105-0x0000000005190000-0x0000000005208000-memory.dmp

memory/4584-106-0x0000000005300000-0x0000000005310000-memory.dmp

memory/4584-107-0x0000000005210000-0x0000000005278000-memory.dmp

memory/4584-108-0x0000000005280000-0x00000000052CC000-memory.dmp

memory/4584-109-0x00000000058D0000-0x0000000005E74000-memory.dmp

memory/4704-110-0x0000000000400000-0x0000000000473000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

memory/4584-115-0x0000000074050000-0x0000000074800000-memory.dmp

memory/4704-117-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4704-114-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4704-118-0x0000000001210000-0x0000000001217000-memory.dmp

memory/2376-121-0x0000000074050000-0x0000000074800000-memory.dmp

memory/4704-120-0x0000000002EA0000-0x00000000032A0000-memory.dmp

memory/4704-119-0x0000000002EA0000-0x00000000032A0000-memory.dmp

memory/4704-122-0x0000000002EA0000-0x00000000032A0000-memory.dmp

memory/4704-124-0x0000000002EA0000-0x00000000032A0000-memory.dmp

memory/2376-123-0x0000000002740000-0x0000000002750000-memory.dmp

memory/4116-125-0x0000017108B30000-0x0000017108B33000-memory.dmp

memory/4704-126-0x0000000003BF0000-0x0000000003C26000-memory.dmp

memory/4704-133-0x0000000002EA0000-0x00000000032A0000-memory.dmp

memory/4704-132-0x0000000003BF0000-0x0000000003C26000-memory.dmp

memory/4704-134-0x0000000002EA0000-0x00000000032A0000-memory.dmp

memory/4116-135-0x0000017108B30000-0x0000017108B33000-memory.dmp

memory/4116-136-0x0000017108DD0000-0x0000017108DD7000-memory.dmp

memory/4116-137-0x00007FF4AE2C0000-0x00007FF4AE3EF000-memory.dmp

memory/4116-138-0x00007FF4AE2C0000-0x00007FF4AE3EF000-memory.dmp

memory/4116-139-0x00007FF4AE2C0000-0x00007FF4AE3EF000-memory.dmp

memory/4116-140-0x00007FF4AE2C0000-0x00007FF4AE3EF000-memory.dmp

memory/4116-141-0x00007FF4AE2C0000-0x00007FF4AE3EF000-memory.dmp

memory/4116-143-0x00007FF4AE2C0000-0x00007FF4AE3EF000-memory.dmp

memory/4116-145-0x00007FF4AE2C0000-0x00007FF4AE3EF000-memory.dmp

memory/4116-146-0x00007FF4AE2C0000-0x00007FF4AE3EF000-memory.dmp

memory/4116-147-0x00007FF4AE2C0000-0x00007FF4AE3EF000-memory.dmp

memory/4116-148-0x00007FFD3EED0000-0x00007FFD3F0C5000-memory.dmp

memory/4116-149-0x00007FF4AE2C0000-0x00007FF4AE3EF000-memory.dmp

memory/4116-150-0x00007FF4AE2C0000-0x00007FF4AE3EF000-memory.dmp

memory/4116-151-0x00007FF4AE2C0000-0x00007FF4AE3EF000-memory.dmp

memory/4116-152-0x00007FF4AE2C0000-0x00007FF4AE3EF000-memory.dmp

memory/4116-153-0x00007FF4AE2C0000-0x00007FF4AE3EF000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/3080-157-0x0000000000260000-0x0000000000412000-memory.dmp

memory/4116-158-0x00007FFD3EED0000-0x00007FFD3F0C5000-memory.dmp

memory/3080-159-0x0000000004D40000-0x0000000004D86000-memory.dmp

memory/3080-160-0x0000000004DB0000-0x0000000004DE4000-memory.dmp

memory/3080-161-0x0000000074050000-0x0000000074800000-memory.dmp

memory/3080-163-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe

MD5 1611ddc5ba7af4c5f4c247c178ccdbb3
SHA1 4be33b42d1def3b0fc027b72efe233b6e05007e5
SHA256 c40a4e9ac9b6cefbfdabd59a314fae01b7fcd0b91e0a7cd8b02afd105a234eb0
SHA512 6d1319e6f8db72bc50e8b77ac470ac1b42e2f34455604b651d1c50f14ad8464cf98feafb4b86f416155980aff9a353a3b6edac944cefa73ebc61b63f5718e0e5

C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe

MD5 1611ddc5ba7af4c5f4c247c178ccdbb3
SHA1 4be33b42d1def3b0fc027b72efe233b6e05007e5
SHA256 c40a4e9ac9b6cefbfdabd59a314fae01b7fcd0b91e0a7cd8b02afd105a234eb0
SHA512 6d1319e6f8db72bc50e8b77ac470ac1b42e2f34455604b651d1c50f14ad8464cf98feafb4b86f416155980aff9a353a3b6edac944cefa73ebc61b63f5718e0e5

memory/3372-167-0x0000000074050000-0x0000000074800000-memory.dmp

memory/3372-166-0x00000000005D0000-0x000000000077E000-memory.dmp

memory/3372-169-0x00000000050A0000-0x00000000050E4000-memory.dmp

memory/3372-175-0x0000000005160000-0x0000000005170000-memory.dmp

memory/3824-177-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2224-181-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3372-182-0x0000000074050000-0x0000000074800000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NSzC8pOj.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

memory/1324-185-0x0000000074050000-0x0000000074800000-memory.dmp

memory/1324-186-0x0000000005560000-0x0000000005570000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\K367)Qpxg.exe

MD5 1611ddc5ba7af4c5f4c247c178ccdbb3
SHA1 4be33b42d1def3b0fc027b72efe233b6e05007e5
SHA256 c40a4e9ac9b6cefbfdabd59a314fae01b7fcd0b91e0a7cd8b02afd105a234eb0
SHA512 6d1319e6f8db72bc50e8b77ac470ac1b42e2f34455604b651d1c50f14ad8464cf98feafb4b86f416155980aff9a353a3b6edac944cefa73ebc61b63f5718e0e5

memory/2224-178-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3080-176-0x0000000074050000-0x0000000074800000-memory.dmp

memory/3824-174-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3372-173-0x0000000005110000-0x0000000005142000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/3824-168-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\NSzC8pOj.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/1324-191-0x0000000074050000-0x0000000074800000-memory.dmp

memory/1516-192-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4116-193-0x0000017108DD0000-0x0000017108DD5000-memory.dmp

memory/4116-194-0x00007FFD3EED0000-0x00007FFD3F0C5000-memory.dmp

memory/3196-195-0x0000000002BD0000-0x0000000002BE6000-memory.dmp

memory/2224-196-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3824-207-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3824-209-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3824-211-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3824-213-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3824-217-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3824-228-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3824-255-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[6E673161-3483].[[email protected]].8base

MD5 842adbe697ebae0c4283aa11a6680d75
SHA1 f0f35e7d2fea0a8100241e6eaee497bddba8bd4a
SHA256 dd70634207873ddab3fa0c9a8c8ea5457b6bbbb54f334e4bdfc5c93615729f50
SHA512 a0c626d4c885b5c0b1ca6687c350caccc59b28db42558b7bec322af5ecdf741b460c73481194a4f0b87bf3202775cb8e9584a007791fa0169f7728b62a40371b

memory/3824-598-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 0c459e65bcc6d38574f0c0d63a87088a
SHA1 41e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256 871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512 be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 6d5040418450624fef735b49ec6bffe9
SHA1 5fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256 dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512 bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 ec41f740797d2253dc1902e71941bbdb
SHA1 407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA256 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512 e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 2ac6d3fcf6913b1a1ac100407e97fccb
SHA1 809f7d4ed348951b79745074487956255d1d0a9a
SHA256 30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA512 79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 ec41f740797d2253dc1902e71941bbdb
SHA1 407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA256 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512 e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 ec41f740797d2253dc1902e71941bbdb
SHA1 407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA256 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512 e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 2ac6d3fcf6913b1a1ac100407e97fccb
SHA1 809f7d4ed348951b79745074487956255d1d0a9a
SHA256 30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA512 79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 2ac6d3fcf6913b1a1ac100407e97fccb
SHA1 809f7d4ed348951b79745074487956255d1d0a9a
SHA256 30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA512 79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

C:\Users\Admin\AppData\Local\Temp\9892.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Temp\9892.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Temp\9892.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/4324-4128-0x0000000074050000-0x0000000074800000-memory.dmp

memory/4324-4154-0x00000000051D0000-0x00000000051E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9A29.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\9A29.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/4608-4323-0x0000000074050000-0x0000000074800000-memory.dmp

memory/4608-4294-0x0000000000EE0000-0x0000000000F5C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9892.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/3988-4364-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4608-4358-0x0000000004A80000-0x0000000004B12000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9E41.exe

MD5 5f0bbf0b4ce5fa0bca57f1230e660dff
SHA1 529e438c21899eff993c0871ce07aff037d7f10d
SHA256 a4c58de9ff779e2b5c28d35dde1884891ab419e909e42c5a164ea576d8348e6d
SHA512 ddede174b3aac4bbf434e1d61da8fa858b4bde11850a75b113376dccb7356f054a9fb696f498cb01c040cec33bb03d75c8c7b2787d46fc33569aeb753ee16131

C:\Users\Admin\AppData\Local\Temp\9E41.exe

MD5 5f0bbf0b4ce5fa0bca57f1230e660dff
SHA1 529e438c21899eff993c0871ce07aff037d7f10d
SHA256 a4c58de9ff779e2b5c28d35dde1884891ab419e909e42c5a164ea576d8348e6d
SHA512 ddede174b3aac4bbf434e1d61da8fa858b4bde11850a75b113376dccb7356f054a9fb696f498cb01c040cec33bb03d75c8c7b2787d46fc33569aeb753ee16131

memory/4324-4361-0x0000000074050000-0x0000000074800000-memory.dmp

memory/4608-4384-0x0000000004B20000-0x0000000004BBC000-memory.dmp

memory/852-4387-0x00000000005B0000-0x00000000005C4000-memory.dmp

memory/852-4398-0x0000000074050000-0x0000000074800000-memory.dmp

memory/852-4409-0x0000000005020000-0x0000000005030000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9FD8.exe

MD5 4345b942eb187e2b867a6e9524d166e0
SHA1 1814c6a4205852069bbaaf9c8bd2809842d52548
SHA256 0b80d7aea7acb5d4bd7e6dbfabeaf5529faec78ff5b29fc525edc2c8bf7e537c
SHA512 85f5ecafcb711af6ace4ddb11ca3a8e8d2a4799ba07d258bb731d55dc36614139db760aeea6e1f1d3674bb045230ba9d247c13d895a7f3f85ea26967788a87d6

C:\Users\Admin\AppData\Local\Temp\9FD8.exe

MD5 4345b942eb187e2b867a6e9524d166e0
SHA1 1814c6a4205852069bbaaf9c8bd2809842d52548
SHA256 0b80d7aea7acb5d4bd7e6dbfabeaf5529faec78ff5b29fc525edc2c8bf7e537c
SHA512 85f5ecafcb711af6ace4ddb11ca3a8e8d2a4799ba07d258bb731d55dc36614139db760aeea6e1f1d3674bb045230ba9d247c13d895a7f3f85ea26967788a87d6

memory/1708-4418-0x0000000000E60000-0x0000000000E74000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A3FF.exe

MD5 4345b942eb187e2b867a6e9524d166e0
SHA1 1814c6a4205852069bbaaf9c8bd2809842d52548
SHA256 0b80d7aea7acb5d4bd7e6dbfabeaf5529faec78ff5b29fc525edc2c8bf7e537c
SHA512 85f5ecafcb711af6ace4ddb11ca3a8e8d2a4799ba07d258bb731d55dc36614139db760aeea6e1f1d3674bb045230ba9d247c13d895a7f3f85ea26967788a87d6

C:\Users\Admin\AppData\Local\Temp\A3FF.exe

MD5 4345b942eb187e2b867a6e9524d166e0
SHA1 1814c6a4205852069bbaaf9c8bd2809842d52548
SHA256 0b80d7aea7acb5d4bd7e6dbfabeaf5529faec78ff5b29fc525edc2c8bf7e537c
SHA512 85f5ecafcb711af6ace4ddb11ca3a8e8d2a4799ba07d258bb731d55dc36614139db760aeea6e1f1d3674bb045230ba9d247c13d895a7f3f85ea26967788a87d6

C:\Users\Admin\AppData\Local\Temp\Ynigope.exe

MD5 695069cac77763a345f1d32305a8c7ce
SHA1 509b592b750bd4f33392b3090494ea96ea966b4c
SHA256 514f00e1db1e1c5e797369e4e422b531e6d9ea2fbeb594cc33f571718037773e
SHA512 7cb60c8d9c6d3ed80e0c6bc902f8ea9243b29a945132c6a648f98ccac07674193c522679dc03fb8708262af000d0da6bf06a7c5e0a76b3946306e475ec3f9dd0

C:\Users\Admin\AppData\Local\Temp\AFC8.exe

MD5 400261992d812b24ecd3bfe79700443c
SHA1 f4f0d341cc860f046b2713939c70da32944f7eda
SHA256 222a5af34881bb68ffc370491a0f8d67b550cd368c49927715946365bbe8038f
SHA512 ed25f5d636658f629625614a95d4bc7a999b10cb2689c38159afa5ff24afd5136119500d00ebe83d880702f9b8e560fb570d92199f56e865eccca9695b8582f9

C:\Users\Admin\AppData\Local\Temp\AFC8.exe

MD5 400261992d812b24ecd3bfe79700443c
SHA1 f4f0d341cc860f046b2713939c70da32944f7eda
SHA256 222a5af34881bb68ffc370491a0f8d67b550cd368c49927715946365bbe8038f
SHA512 ed25f5d636658f629625614a95d4bc7a999b10cb2689c38159afa5ff24afd5136119500d00ebe83d880702f9b8e560fb570d92199f56e865eccca9695b8582f9

C:\Users\Admin\AppData\Local\Temp\Ynigope.exe

MD5 695069cac77763a345f1d32305a8c7ce
SHA1 509b592b750bd4f33392b3090494ea96ea966b4c
SHA256 514f00e1db1e1c5e797369e4e422b531e6d9ea2fbeb594cc33f571718037773e
SHA512 7cb60c8d9c6d3ed80e0c6bc902f8ea9243b29a945132c6a648f98ccac07674193c522679dc03fb8708262af000d0da6bf06a7c5e0a76b3946306e475ec3f9dd0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ddwqx74p.default-release\cookies.sqlite.id[6E673161-3483].[[email protected]].8base

MD5 bac3662ee8452e0864b5069e9c3fd60f
SHA1 976ab0f17b7bd03daa6afcc526a787658f0a82a0
SHA256 92569e4252e6158fa1f27ed460f2ad20029d010cd24efb0db17857198a6ad5d1
SHA512 c9ccb6e67a96309a66cf1515367c337e75bb173d08294f81553732f758bb9b5f6f9caf14cf2e09225c1f00771a7edb2aef50866a08603fd60202ea26ba2f2be0

C:\Users\Admin\AppData\Local\Temp\Ynigope.exe

MD5 695069cac77763a345f1d32305a8c7ce
SHA1 509b592b750bd4f33392b3090494ea96ea966b4c
SHA256 514f00e1db1e1c5e797369e4e422b531e6d9ea2fbeb594cc33f571718037773e
SHA512 7cb60c8d9c6d3ed80e0c6bc902f8ea9243b29a945132c6a648f98ccac07674193c522679dc03fb8708262af000d0da6bf06a7c5e0a76b3946306e475ec3f9dd0

C:\Users\Admin\AppData\Local\Temp\Ynigope.exe

MD5 695069cac77763a345f1d32305a8c7ce
SHA1 509b592b750bd4f33392b3090494ea96ea966b4c
SHA256 514f00e1db1e1c5e797369e4e422b531e6d9ea2fbeb594cc33f571718037773e
SHA512 7cb60c8d9c6d3ed80e0c6bc902f8ea9243b29a945132c6a648f98ccac07674193c522679dc03fb8708262af000d0da6bf06a7c5e0a76b3946306e475ec3f9dd0

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aspnet_compiler.exe.log

MD5 c0aed85f01118e3d67e3b2a514a7a36b
SHA1 773e349d3ccadf77c7025d0450a337c538869f14
SHA256 1c144975fd84bd986810e9067c6381939683de5e00223dad95bb7fd85e157d62
SHA512 09027ddc074a09edc7da397af8369cf2bbf8c1c68f0ecac02151ea595a2e9499775abaa40e9b51fb96a9895a4901bd29daf7b83e93cc1f1f9ac64c39c999277d

C:\Users\Admin\AppData\Local\Temp\EBA3.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\EBA3.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Ynigope.exe.log

MD5 84d1c0a4002c137a46d4c1ba97121096
SHA1 84b83d6904eb75875adeca9fd5e9f285242b294b
SHA256 c40fba2b688c099f4abb0adab1e4c15acb1c5d2acb1975e0217e7d647e6fd04c
SHA512 5f143d6e5d571f37fd381cc071271c3931f46b985a48a70e3d7fcfe00c6e32512861a99a66b7b297bcb356e67e020e8c994cbf2840a6af2bd5317be8aab7bdde

C:\info.hta

MD5 d9cd0602214172de4d37e395b588f1d8
SHA1 74959f8fcd2d9db30d70aa54aae5d6f6d4de7fbf
SHA256 04fd97a7e6a51ad8d42cbda19b6fc0ccfb11cad24cfb34c4076fb7746fd041b6
SHA512 9aee7fe6a2c693da398d7c5981e5e99e49ba6682d11041884b5916bbaef85465f6343d35411fa1e62f6110d3bb26f85d3f61696295a7f6bbb533b360beb9fa25