Malware Analysis Report

2024-10-16 05:11

Sample ID 230923-316emaah7v
Target 436433b28ed3f1193f8fbcd52a80edde7ee113277c2d1f12a598a7b6709fd881
SHA256 436433b28ed3f1193f8fbcd52a80edde7ee113277c2d1f12a598a7b6709fd881
Tags
amadey ammyyadmin flawedammyy healer phobos redline rhadamanthys smokeloader nanya backdoor bootkit collection dropper evasion infostealer persistence ransomware rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

436433b28ed3f1193f8fbcd52a80edde7ee113277c2d1f12a598a7b6709fd881

Threat Level: Known bad

The file 436433b28ed3f1193f8fbcd52a80edde7ee113277c2d1f12a598a7b6709fd881 was found to be: Known bad.

Malicious Activity Summary

amadey ammyyadmin flawedammyy healer phobos redline rhadamanthys smokeloader nanya backdoor bootkit collection dropper evasion infostealer persistence ransomware rat spyware stealer trojan

Ammyy Admin

Detects Healer an antivirus disabler dropper

Suspicious use of NtCreateUserProcessOtherParentProcess

Healer

SmokeLoader

RedLine

Detect rhadamanthys stealer shellcode

Modifies Windows Defender Real-time Protection settings

Phobos

Amadey

AmmyyAdmin payload

FlawedAmmyy RAT

RedLine payload

Rhadamanthys

Renames multiple (470) files with added filename extension

Deletes shadow copies

Modifies boot configuration data using bcdedit

Downloads MZ/PE file

Modifies Windows Firewall

Deletes backup catalog

Reads user/profile data of web browsers

Drops startup file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Writes to the Master Boot Record (MBR)

Accesses Microsoft Outlook profiles

Adds Run key to start application

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Program crash

Checks SCSI registry key(s)

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

outlook_win_path

Suspicious use of UnmapMainImage

Suspicious use of AdjustPrivilegeToken

Interacts with shadow copies

Creates scheduled task(s)

Modifies registry class

Uses Task Scheduler COM API

Checks processor information in registry

Suspicious use of WriteProcessMemory

outlook_office_path

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-09-23 23:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-23 23:59

Reported

2023-09-24 00:02

Platform

win10v2004-20230915-en

Max time kernel

150s

Max time network

155s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A

FlawedAmmyy RAT

trojan flawedammyy

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Phobos

ransomware phobos

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4548 created 2568 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (470) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6979127.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4772192.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\F8D2.tmp\svchost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0099674.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0893874.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2626359.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9232830.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1984230.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6979127.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4772192.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7749071.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`iisMzWUXO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`iisMzWUXO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AD04.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AE9B.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AD04.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BB10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F8D2.tmp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AE9B.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SYSTEM32\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2626359.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9232830.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\U`Y4C = "C:\\Users\\Admin\\AppData\\Local\\U`Y4C.exe" C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\U`Y4C = "C:\\Users\\Admin\\AppData\\Local\\U`Y4C.exe" C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\436433b28ed3f1193f8fbcd52a80edde7ee113277c2d1f12a598a7b6709fd881.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0099674.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0893874.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-3027552071-446050021-1254071215-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3027552071-446050021-1254071215-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\F8D2.tmp\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr_2x.gif.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-60.png C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyResume.dotx C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\main-selector.css C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\plugin.js.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\manifest.json.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\ui-strings.js.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files\Java\jre1.8.0_66\lib\javaws.jar.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-100.png C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSmallTile.scale-100.png C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\PointerIndicatorVertexShader.cso C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Design.resources.dll C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\MedTile.scale-125.png C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\ui-strings.js.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\ui-strings.js.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\msadc\es-ES\msdaprsr.dll.mui C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-200.png C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.map.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-48_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\ADALPREVIOUS.DLL C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\dbghelp.dll C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookAccount.scale-100.png C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\BuiltinResearcher.xml C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\ui-strings.js.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\QUAD.ELM.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-60_altform-lightunplated.png C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\LargeTile.scale-100.png C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\check.cur.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\AppStore_icon.svg.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\IRIS.INF.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-125.png C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\SmallTile.scale-200.png C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-phn.xrm-ms.id[0F40F3B1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\BadgeLogo.scale-125.png C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\195.png C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\`iisMzWUXO.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\`iisMzWUXO.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\`iisMzWUXO.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`iisMzWUXO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`iisMzWUXO.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\`iisMzWUXO.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AD04.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AE9B.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\BB10.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\F8D2.tmp\svchost.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4292 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\436433b28ed3f1193f8fbcd52a80edde7ee113277c2d1f12a598a7b6709fd881.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0099674.exe
PID 4292 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\436433b28ed3f1193f8fbcd52a80edde7ee113277c2d1f12a598a7b6709fd881.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0099674.exe
PID 4292 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\436433b28ed3f1193f8fbcd52a80edde7ee113277c2d1f12a598a7b6709fd881.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0099674.exe
PID 2400 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0099674.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0893874.exe
PID 2400 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0099674.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0893874.exe
PID 2400 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0099674.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0893874.exe
PID 1704 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0893874.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2626359.exe
PID 1704 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0893874.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2626359.exe
PID 1704 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0893874.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2626359.exe
PID 4772 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2626359.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9232830.exe
PID 4772 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2626359.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9232830.exe
PID 4772 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2626359.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9232830.exe
PID 5112 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9232830.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe
PID 5112 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9232830.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe
PID 5112 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9232830.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe
PID 3436 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3436 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3436 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3436 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3436 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3436 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3436 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3436 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3436 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3436 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3436 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5112 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9232830.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe
PID 5112 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9232830.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe
PID 5112 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9232830.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe
PID 4560 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4560 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4560 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4560 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4560 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4560 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4560 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4560 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4560 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4560 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4772 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2626359.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1984230.exe
PID 4772 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2626359.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1984230.exe
PID 4772 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2626359.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1984230.exe
PID 4500 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1984230.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4500 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1984230.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4500 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1984230.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4500 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1984230.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4500 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1984230.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4500 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1984230.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4500 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1984230.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4500 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1984230.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1704 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0893874.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6979127.exe
PID 1704 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0893874.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6979127.exe
PID 1704 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0893874.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6979127.exe
PID 1636 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6979127.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
PID 1636 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6979127.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
PID 1636 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6979127.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
PID 2400 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0099674.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4772192.exe
PID 2400 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0099674.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4772192.exe
PID 2400 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0099674.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4772192.exe
PID 4956 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe C:\Windows\SysWOW64\schtasks.exe
PID 4956 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe C:\Windows\SysWOW64\schtasks.exe
PID 4956 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe C:\Windows\SysWOW64\schtasks.exe
PID 4956 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe C:\Windows\SysWOW64\cmd.exe
PID 4956 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe C:\Windows\SysWOW64\cmd.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\436433b28ed3f1193f8fbcd52a80edde7ee113277c2d1f12a598a7b6709fd881.exe

"C:\Users\Admin\AppData\Local\Temp\436433b28ed3f1193f8fbcd52a80edde7ee113277c2d1f12a598a7b6709fd881.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0099674.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0099674.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0893874.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0893874.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2626359.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2626359.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9232830.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9232830.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3436 -ip 3436

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 572

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4560 -ip 4560

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4672 -ip 4672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 540

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1984230.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1984230.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4500 -ip 4500

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 580

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6979127.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6979127.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4772192.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4772192.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7749071.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7749071.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explonde.exe" /P "Admin:N"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cacls.exe

CACLS "explonde.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legota.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legota.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\cb378487cf" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\cb378487cf" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

"C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe"

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe

"C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe"

C:\Users\Admin\AppData\Local\Microsoft\`iisMzWUXO.exe

"C:\Users\Admin\AppData\Local\Microsoft\`iisMzWUXO.exe"

C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe

C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe

C:\Users\Admin\AppData\Local\Microsoft\`iisMzWUXO.exe

C:\Users\Admin\AppData\Local\Microsoft\`iisMzWUXO.exe

C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe

"C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe"

C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe

C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

C:\Users\Admin\AppData\Local\Temp\AD04.exe

C:\Users\Admin\AppData\Local\Temp\AD04.exe

C:\Users\Admin\AppData\Local\Temp\AE9B.exe

C:\Users\Admin\AppData\Local\Temp\AE9B.exe

C:\Users\Admin\AppData\Local\Temp\AD04.exe

C:\Users\Admin\AppData\Local\Temp\AD04.exe

C:\Users\Admin\AppData\Local\Temp\BB10.exe

C:\Users\Admin\AppData\Local\Temp\BB10.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4136 -ip 4136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 1916

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\AE9B.exe

"C:\Users\Admin\AppData\Local\Temp\AE9B.exe"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4136 -ip 4136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 1916

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\F8D2.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\F8D2.tmp\svchost.exe -debug

C:\Windows\SYSTEM32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\F8D2.tmp\aa_nts.dll",run

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 39.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
FI 77.91.124.82:19071 tcp
FI 77.91.68.52:80 77.91.68.52 tcp
FI 77.91.68.78:80 77.91.68.78 tcp
US 8.8.8.8:53 amx385.xyz udp
DE 45.89.127.193:80 amx385.xyz tcp
US 8.8.8.8:53 52.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 78.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 193.127.89.45.in-addr.arpa udp
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 61.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.124.82:19071 tcp
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
FI 77.91.68.52:80 77.91.68.52 tcp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
FI 77.91.68.78:80 77.91.68.78 tcp
FI 77.91.124.82:19071 tcp
IE 52.111.236.21:443 tcp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 mksad917.xyz udp
DE 193.31.28.70:80 mksad917.xyz tcp
US 8.8.8.8:53 120.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 70.28.31.193.in-addr.arpa udp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
US 8.8.8.8:53 qu.ax udp
IL 91.226.72.136:443 qu.ax tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 136.72.226.91.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
FI 77.91.124.82:19071 tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
US 8.8.8.8:53 148.129.42.188.in-addr.arpa udp
DE 136.243.104.242:443 tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 242.104.243.136.in-addr.arpa udp
US 8.8.8.8:53 www.ammyy.com udp
DE 136.243.18.118:80 www.ammyy.com tcp
DE 136.243.18.118:443 www.ammyy.com tcp
US 8.8.8.8:53 147.174.42.23.in-addr.arpa udp
US 8.8.8.8:53 118.18.243.136.in-addr.arpa udp
US 8.8.8.8:53 9.175.53.84.in-addr.arpa udp
FI 77.91.124.82:19071 tcp
US 8.8.8.8:53 195.98.74.40.in-addr.arpa udp
FI 77.91.124.82:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0099674.exe

MD5 ae79849236d42721859d27de957aeb3a
SHA1 282fac3f4cca6c539b181261ae95724f279c3a3a
SHA256 97f51996e37ea1850540a7c13d7f5333f1e35328a629b07a6f99d555cdd7dd8b
SHA512 c670d372c1b9b8d8df0c2b674932fecff4835d53b446f84c2c660f0cf96d38699b71e4674197535599cd5f6516aad5b3bb6d27947ab29776db1886ea2be90d17

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0099674.exe

MD5 ae79849236d42721859d27de957aeb3a
SHA1 282fac3f4cca6c539b181261ae95724f279c3a3a
SHA256 97f51996e37ea1850540a7c13d7f5333f1e35328a629b07a6f99d555cdd7dd8b
SHA512 c670d372c1b9b8d8df0c2b674932fecff4835d53b446f84c2c660f0cf96d38699b71e4674197535599cd5f6516aad5b3bb6d27947ab29776db1886ea2be90d17

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0893874.exe

MD5 0e73462e8df3509c2b0cb282d8818b48
SHA1 84ef7ab8bb27f60eb8d48eeef32ca382aae168af
SHA256 cacb16675788a395b6d4aba5abc7f100b465a04f79699912873ffcc63b46dbaf
SHA512 9f8e7cb1e7adaff549178677f1a124e0bad32f6ad3d31001b433e3c8dbf26939fd86d89e02aa29276646873f54016f801e156c5b705e35aad598a76a7ef96616

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0893874.exe

MD5 0e73462e8df3509c2b0cb282d8818b48
SHA1 84ef7ab8bb27f60eb8d48eeef32ca382aae168af
SHA256 cacb16675788a395b6d4aba5abc7f100b465a04f79699912873ffcc63b46dbaf
SHA512 9f8e7cb1e7adaff549178677f1a124e0bad32f6ad3d31001b433e3c8dbf26939fd86d89e02aa29276646873f54016f801e156c5b705e35aad598a76a7ef96616

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2626359.exe

MD5 390754c221e661ff91f03bb19a088103
SHA1 163e849496642df60356b5f8a98921dba9159ada
SHA256 9818d3e291d988eb203b182038101b07f55fe0dea28b61f590659174f2b2e711
SHA512 0ed87e0c70e30b34e92336730340cb631872eb234eeff9f46043cf6349d6ee0f844078e6f1155fac8e4dc02f2df5830a614e6ea54af5ac25d0a0ce8a67ea1325

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2626359.exe

MD5 390754c221e661ff91f03bb19a088103
SHA1 163e849496642df60356b5f8a98921dba9159ada
SHA256 9818d3e291d988eb203b182038101b07f55fe0dea28b61f590659174f2b2e711
SHA512 0ed87e0c70e30b34e92336730340cb631872eb234eeff9f46043cf6349d6ee0f844078e6f1155fac8e4dc02f2df5830a614e6ea54af5ac25d0a0ce8a67ea1325

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9232830.exe

MD5 dc505aaf41cc412e28304277da94dcf1
SHA1 fa42e886938d87fb76caa2b334fd6506fadd6f8f
SHA256 072383ae5dc901e494b5f0d586823826a8aac74965dadd68d8c7a5590da80f1e
SHA512 f4390a5341deea69f9209a3bffcd43106e0749ccc6cd1ce4655a3a55a34fdaf4e2b4577004b5b4501357707b41ea6f6b76544ccbd07d99850679ec03234455d6

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9232830.exe

MD5 dc505aaf41cc412e28304277da94dcf1
SHA1 fa42e886938d87fb76caa2b334fd6506fadd6f8f
SHA256 072383ae5dc901e494b5f0d586823826a8aac74965dadd68d8c7a5590da80f1e
SHA512 f4390a5341deea69f9209a3bffcd43106e0749ccc6cd1ce4655a3a55a34fdaf4e2b4577004b5b4501357707b41ea6f6b76544ccbd07d99850679ec03234455d6

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe

MD5 b52554aea644d08513f4691b9a33de07
SHA1 80f14d1aa3b15f29540ea674c60b6929736c97f6
SHA256 882d1cc81e549b3b7cacbae2deb8ffdbdc49510bb2b2488837c045b14507701e
SHA512 d757c29c2082d0654a969e064f29592d2737aba1b9e045ac7565c51eaece0e7ae5fb5898cdd76b3dcde0f5631588d7b74cecadafe7f644808a18ee4bd9499d57

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5059515.exe

MD5 b52554aea644d08513f4691b9a33de07
SHA1 80f14d1aa3b15f29540ea674c60b6929736c97f6
SHA256 882d1cc81e549b3b7cacbae2deb8ffdbdc49510bb2b2488837c045b14507701e
SHA512 d757c29c2082d0654a969e064f29592d2737aba1b9e045ac7565c51eaece0e7ae5fb5898cdd76b3dcde0f5631588d7b74cecadafe7f644808a18ee4bd9499d57

memory/452-35-0x0000000000400000-0x000000000040A000-memory.dmp

memory/452-36-0x00000000742F0000-0x0000000074AA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe

MD5 6959b71418a4c832362cb5be239343d7
SHA1 9f7fa9187b98433527d530e19843dfaf2248a797
SHA256 e00b40ccf90c3765b881f3defffcfba3984fe27f2eddbce14b27cf7302aa09b6
SHA512 d51cc27a4526cffbfbab898a875569bd5ddb414610879f68b7a023eedbe17d0c8f9a8bfcbfa89c95a7871228c8443905b4677bfbc304fcc0e06c06b95ff897c2

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9881150.exe

MD5 6959b71418a4c832362cb5be239343d7
SHA1 9f7fa9187b98433527d530e19843dfaf2248a797
SHA256 e00b40ccf90c3765b881f3defffcfba3984fe27f2eddbce14b27cf7302aa09b6
SHA512 d51cc27a4526cffbfbab898a875569bd5ddb414610879f68b7a023eedbe17d0c8f9a8bfcbfa89c95a7871228c8443905b4677bfbc304fcc0e06c06b95ff897c2

memory/4672-40-0x0000000000400000-0x000000000042C000-memory.dmp

memory/4672-41-0x0000000000400000-0x000000000042C000-memory.dmp

memory/4672-42-0x0000000000400000-0x000000000042C000-memory.dmp

memory/4672-44-0x0000000000400000-0x000000000042C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1984230.exe

MD5 f087377c3b133c87182cc95d159562fd
SHA1 a11fd2c9a6c35911a5faba41ba385721c53c8181
SHA256 c099666080ef9a984f009cde96eac60dee5fa216deb267f355d5146f4ba658dc
SHA512 d24a43a12f2bb0499ac5f69823feeaff89cc5b71a44157c3559e636be6fb300cb3c32e34929085a1cdd5569931d092ad43a84ff944b6fa07714215d2f1ba9d9c

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1984230.exe

MD5 f087377c3b133c87182cc95d159562fd
SHA1 a11fd2c9a6c35911a5faba41ba385721c53c8181
SHA256 c099666080ef9a984f009cde96eac60dee5fa216deb267f355d5146f4ba658dc
SHA512 d24a43a12f2bb0499ac5f69823feeaff89cc5b71a44157c3559e636be6fb300cb3c32e34929085a1cdd5569931d092ad43a84ff944b6fa07714215d2f1ba9d9c

memory/4356-48-0x0000000000400000-0x0000000000430000-memory.dmp

memory/4356-50-0x00000000742F0000-0x0000000074AA0000-memory.dmp

memory/4356-49-0x0000000000F40000-0x0000000000F46000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6979127.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6979127.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

memory/4356-54-0x0000000005590000-0x0000000005BA8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

memory/4356-57-0x0000000005080000-0x000000000518A000-memory.dmp

memory/4356-58-0x0000000004F90000-0x0000000004FA2000-memory.dmp

memory/452-59-0x00000000742F0000-0x0000000074AA0000-memory.dmp

memory/4356-60-0x0000000004F60000-0x0000000004F70000-memory.dmp

memory/4356-61-0x0000000004FF0000-0x000000000502C000-memory.dmp

memory/4356-62-0x0000000005030000-0x000000000507C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

memory/452-71-0x00000000742F0000-0x0000000074AA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4772192.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4772192.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7749071.exe

MD5 0fdce418bade6666b3e723b3d55d85dd
SHA1 adcaad293baeeed11523f04d9f9ae9efac5f43d3
SHA256 f3811b24278f849e30a675ee9b582f0787894946e002c5ed5600a81de9f38575
SHA512 d80f0a9cd4020a4b39e6aedfe48f7759f7734bbe7c75bf1535e4cfbabbdb9b80f8d5a101dfeedcacfd4e03d7990426aede1a5b05a4f0994a1572d428586f26e0

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7749071.exe

MD5 0fdce418bade6666b3e723b3d55d85dd
SHA1 adcaad293baeeed11523f04d9f9ae9efac5f43d3
SHA256 f3811b24278f849e30a675ee9b582f0787894946e002c5ed5600a81de9f38575
SHA512 d80f0a9cd4020a4b39e6aedfe48f7759f7734bbe7c75bf1535e4cfbabbdb9b80f8d5a101dfeedcacfd4e03d7990426aede1a5b05a4f0994a1572d428586f26e0

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

memory/2912-103-0x0000000000010000-0x00000000001F6000-memory.dmp

memory/2912-104-0x00000000742F0000-0x0000000074AA0000-memory.dmp

memory/2912-105-0x0000000004B90000-0x0000000004C08000-memory.dmp

memory/2912-106-0x0000000004C20000-0x0000000004C30000-memory.dmp

memory/2912-107-0x0000000004C30000-0x0000000004C98000-memory.dmp

memory/2912-108-0x0000000004CA0000-0x0000000004CEC000-memory.dmp

memory/2912-109-0x00000000052D0000-0x0000000005874000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

memory/4548-112-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2912-116-0x00000000742F0000-0x0000000074AA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

memory/4548-117-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4548-119-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4356-120-0x00000000742F0000-0x0000000074AA0000-memory.dmp

memory/4548-121-0x0000000001560000-0x0000000001567000-memory.dmp

memory/4548-122-0x00000000031D0000-0x00000000035D0000-memory.dmp

memory/4356-123-0x0000000004F60000-0x0000000004F70000-memory.dmp

memory/4548-125-0x00000000031D0000-0x00000000035D0000-memory.dmp

memory/4548-124-0x00000000031D0000-0x00000000035D0000-memory.dmp

memory/4548-126-0x00000000031D0000-0x00000000035D0000-memory.dmp

memory/3352-127-0x000001FC77920000-0x000001FC77923000-memory.dmp

memory/4548-128-0x0000000004010000-0x0000000004046000-memory.dmp

memory/4548-135-0x00000000031D0000-0x00000000035D0000-memory.dmp

memory/4548-134-0x0000000004010000-0x0000000004046000-memory.dmp

memory/3352-136-0x000001FC77920000-0x000001FC77923000-memory.dmp

memory/3352-137-0x000001FC77AC0000-0x000001FC77AC7000-memory.dmp

memory/3352-139-0x00007FF4B3710000-0x00007FF4B383F000-memory.dmp

memory/3352-138-0x00007FF4B3710000-0x00007FF4B383F000-memory.dmp

memory/3352-140-0x00007FF4B3710000-0x00007FF4B383F000-memory.dmp

memory/3352-141-0x00007FF4B3710000-0x00007FF4B383F000-memory.dmp

memory/3352-142-0x00007FF4B3710000-0x00007FF4B383F000-memory.dmp

memory/3352-144-0x00007FF4B3710000-0x00007FF4B383F000-memory.dmp

memory/3352-146-0x00007FF4B3710000-0x00007FF4B383F000-memory.dmp

memory/3352-148-0x00007FF4B3710000-0x00007FF4B383F000-memory.dmp

memory/3352-147-0x00007FF4B3710000-0x00007FF4B383F000-memory.dmp

memory/3352-149-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

memory/3352-150-0x00007FF4B3710000-0x00007FF4B383F000-memory.dmp

memory/3352-151-0x00007FF4B3710000-0x00007FF4B383F000-memory.dmp

memory/3352-152-0x00007FF4B3710000-0x00007FF4B383F000-memory.dmp

memory/3352-153-0x00007FF4B3710000-0x00007FF4B383F000-memory.dmp

memory/3352-154-0x00007FF4B3710000-0x00007FF4B383F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

memory/2912-158-0x0000000000BD0000-0x0000000000C18000-memory.dmp

memory/2912-159-0x00000000742F0000-0x0000000074AA0000-memory.dmp

memory/2912-160-0x0000000005420000-0x0000000005466000-memory.dmp

memory/3352-162-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

memory/2912-163-0x0000000005580000-0x0000000005590000-memory.dmp

memory/2912-164-0x00000000054A0000-0x00000000054D4000-memory.dmp

memory/3884-167-0x0000000000BA0000-0x0000000000BE4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\`iisMzWUXO.exe

MD5 f303bcd11ab0d3f55980064dee528ab5
SHA1 815aaa887d7991ec9dcda8f0e1adea12f76aa789
SHA256 21fb9e94c2c0cd34955a9315539053cf736135254de72bfab497c88d01ee76f0
SHA512 371cc13d036b31ac71cd19c308d4e608e3225380c57de9d8448fb5849ad1c465ea51de1c9bd39d8570a807f5222c2853e5c10a59583ffcc96cffe52765741cf6

C:\Users\Admin\AppData\Local\Microsoft\`iisMzWUXO.exe

MD5 f303bcd11ab0d3f55980064dee528ab5
SHA1 815aaa887d7991ec9dcda8f0e1adea12f76aa789
SHA256 21fb9e94c2c0cd34955a9315539053cf736135254de72bfab497c88d01ee76f0
SHA512 371cc13d036b31ac71cd19c308d4e608e3225380c57de9d8448fb5849ad1c465ea51de1c9bd39d8570a807f5222c2853e5c10a59583ffcc96cffe52765741cf6

memory/3884-168-0x0000000002E30000-0x0000000002E74000-memory.dmp

memory/3884-169-0x00000000742F0000-0x0000000074AA0000-memory.dmp

memory/4948-172-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

memory/2912-177-0x00000000742F0000-0x0000000074AA0000-memory.dmp

memory/4948-178-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3224-179-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4948-176-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3884-171-0x0000000005470000-0x00000000054A2000-memory.dmp

memory/3884-170-0x0000000005590000-0x00000000055A0000-memory.dmp

memory/3224-182-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\`iisMzWUXO.exe

MD5 f303bcd11ab0d3f55980064dee528ab5
SHA1 815aaa887d7991ec9dcda8f0e1adea12f76aa789
SHA256 21fb9e94c2c0cd34955a9315539053cf736135254de72bfab497c88d01ee76f0
SHA512 371cc13d036b31ac71cd19c308d4e608e3225380c57de9d8448fb5849ad1c465ea51de1c9bd39d8570a807f5222c2853e5c10a59583ffcc96cffe52765741cf6

memory/3884-183-0x00000000742F0000-0x0000000074AA0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\U`Y4C.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

memory/3380-186-0x00000000742F0000-0x0000000074AA0000-memory.dmp

memory/3380-187-0x0000000004B80000-0x0000000004B90000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\U`Y4C.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

memory/3380-191-0x00000000742F0000-0x0000000074AA0000-memory.dmp

memory/4680-193-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2568-194-0x0000000000880000-0x0000000000896000-memory.dmp

memory/3224-196-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4948-207-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4948-208-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4948-210-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4948-213-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4948-226-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4948-214-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4948-212-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id[0F40F3B1-3483].[[email protected]].8base

MD5 15c25be045cf0098694603a8d002bab2
SHA1 48baa29384e7679615249a8a07ac2be0102cfad0
SHA256 193311a935c127ea9f651d40d1d55b9dab218e98492e7b1c76fd6c053aaf1675
SHA512 b4aad21364af1c28d7af7ec2eeb34425d94553c9f298ca3fbea39a0283b7ada8ee6d8f71cd0b1338f5d9cd55713c440a83c4f23ac0cdba26d331adc7aae6f768

memory/4948-735-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 0c459e65bcc6d38574f0c0d63a87088a
SHA1 41e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256 871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512 be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 2ac6d3fcf6913b1a1ac100407e97fccb
SHA1 809f7d4ed348951b79745074487956255d1d0a9a
SHA256 30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA512 79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 2ac6d3fcf6913b1a1ac100407e97fccb
SHA1 809f7d4ed348951b79745074487956255d1d0a9a
SHA256 30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA512 79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 6d5040418450624fef735b49ec6bffe9
SHA1 5fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256 dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512 bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 2ac6d3fcf6913b1a1ac100407e97fccb
SHA1 809f7d4ed348951b79745074487956255d1d0a9a
SHA256 30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA512 79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 ec41f740797d2253dc1902e71941bbdb
SHA1 407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA256 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512 e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 ec41f740797d2253dc1902e71941bbdb
SHA1 407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA256 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512 e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 ec41f740797d2253dc1902e71941bbdb
SHA1 407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA256 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512 e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

memory/3352-1288-0x000001FC77AC0000-0x000001FC77AC5000-memory.dmp

memory/3352-1289-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AD04.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

C:\Users\Admin\AppData\Local\Temp\AD04.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

C:\Users\Admin\AppData\Local\Temp\AD04.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

memory/3296-4288-0x00000000742F0000-0x0000000074AA0000-memory.dmp

memory/3296-4325-0x0000000000D80000-0x0000000000D90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AE9B.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\AE9B.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/5040-4383-0x0000000000F90000-0x000000000100C000-memory.dmp

memory/5040-4382-0x00000000742F0000-0x0000000074AA0000-memory.dmp

memory/5040-4410-0x0000000005000000-0x0000000005092000-memory.dmp

memory/5040-4428-0x00000000050A0000-0x000000000513C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AD04.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

memory/3296-4445-0x00000000742F0000-0x0000000074AA0000-memory.dmp

memory/1560-4446-0x0000000000400000-0x0000000000413000-memory.dmp

memory/5040-4453-0x0000000005F20000-0x0000000005F30000-memory.dmp

memory/5040-4484-0x0000000005E60000-0x0000000005EA2000-memory.dmp

memory/5040-4531-0x0000000006230000-0x000000000623A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BB10.exe

MD5 400261992d812b24ecd3bfe79700443c
SHA1 f4f0d341cc860f046b2713939c70da32944f7eda
SHA256 222a5af34881bb68ffc370491a0f8d67b550cd368c49927715946365bbe8038f
SHA512 ed25f5d636658f629625614a95d4bc7a999b10cb2689c38159afa5ff24afd5136119500d00ebe83d880702f9b8e560fb570d92199f56e865eccca9695b8582f9

memory/4136-4743-0x00000000009C0000-0x0000000000B3A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BB10.exe

MD5 400261992d812b24ecd3bfe79700443c
SHA1 f4f0d341cc860f046b2713939c70da32944f7eda
SHA256 222a5af34881bb68ffc370491a0f8d67b550cd368c49927715946365bbe8038f
SHA512 ed25f5d636658f629625614a95d4bc7a999b10cb2689c38159afa5ff24afd5136119500d00ebe83d880702f9b8e560fb570d92199f56e865eccca9695b8582f9

memory/4136-4745-0x00000000742F0000-0x0000000074AA0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b7jtu2fw.default-release\cookies.sqlite.id[0F40F3B1-3483].[[email protected]].8base

MD5 55faddfe0b2ac01c0a0be515fc39f1fb
SHA1 4e70295d8ba40a8454c4ad135f3edc31dad3e371
SHA256 674e172b14247742074556af708afd267a5f23c696e58e327218512ae240abc6
SHA512 86824a110689b55c40b9030af8e2c819eba52d36e52c0be20f0cf387af627cf4740a4830a96285272758893f9c9e91981e6dc3b394eb168f2985fe70b768b530

C:\Users\Admin\AppData\Local\Temp\F8D2.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\F8D2.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\F8D2.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\F8D2.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\F8D2.tmp\aa_nts.msg

MD5 3f05819f995b4dafa1b5d55ce8d1f411
SHA1 404449b79a16bfc4f64f2fd55cd73d5d27a85d71
SHA256 7e0bf0cbd06a087500a9c3b50254df3a8a2c2980921ab6a62ab1121941c80fc0
SHA512 34abb7df8b3a68e1649ff0d2762576a4d4e65da548e74b1aa65c2b82c1b89f90d053ecddac67c614ca6084dc5b2cb552949250fb70f49b536f1bcb0057717026

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rh111.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AD04.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\`iisMzWUXO.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000026.db.id[0F40F3B1-3483].[[email protected]].8base

MD5 15d9e49287bb5629ccd106b02fe3d0d4
SHA1 1fa4790ac2056a9d5c20d4396a8963adcdb35ce1
SHA256 7f40a0f612f7179f94eedc1d59f2efc0e8af2cbdb3180eafcdd665ffc2bffb23
SHA512 43c34ba6f48f919ef52e91a9ccb450da29e132831dfc889b5be32a12b879f6e41bd3d196a403453505c173d5150c90216a725e8eabe11c140917ae19c746b08a

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MBSMWSRL\rh111[1].exe

MD5 da5b9806aea6346221df3cf8c76814f8
SHA1 fd177d2e9ca22b6329f73d908e21a4c7de639f3d
SHA256 d3fde9b1b31dd3c14eceb149fddb8caf4965fd11fa8adbfcb672e0ea0b502839
SHA512 b66af8a9bc9818ddcefe8156aa904c3afab286f9873a5ad282c4d32e0e5e58219a251721a1003acf85607e5b3395e21a371a0181a93bfa4eb95c1f197449cf84

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q7SK9IL3\clip64[1].dll

MD5 2ac6d3fcf6913b1a1ac100407e97fccb
SHA1 809f7d4ed348951b79745074487956255d1d0a9a
SHA256 30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA512 79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

C:\info.hta

MD5 03d728180c69a311e978d066de0a362b
SHA1 96f7c5333e02703f0bdb184a3fa50459a23c3964
SHA256 98fbcfcc10f199bf9d98be4a0dfb1c143f27504b46a2cb7e1eb045cdf0c8cb3f
SHA512 2d06f89b9d8789fd458b8dce49e651ab47bf1af56fd52a7b9c54889f93938255f05ffcc5d3918d9ad8a3ba46d51cb797fd19a1d1795dee6e67720069d974fe10