Malware Analysis Report

2024-10-16 05:11

Sample ID 230923-yasnmabh47
Target fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
SHA256 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b
Tags
ammyyadmin phobos rhadamanthys collection evasion persistence ransomware rat stealer spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b

Threat Level: Known bad

The file fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe was found to be: Known bad.

Malicious Activity Summary

ammyyadmin phobos rhadamanthys collection evasion persistence ransomware rat stealer spyware

Ammyy Admin

Detect rhadamanthys stealer shellcode

Phobos

AmmyyAdmin payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Rhadamanthys

Deletes shadow copies

Renames multiple (99) files with added filename extension

Renames multiple (92) files with added filename extension

Modifies boot configuration data using bcdedit

Downloads MZ/PE file

Deletes backup catalog

Modifies Windows Firewall

Executes dropped EXE

Deletes itself

Reads user/profile data of web browsers

Loads dropped DLL

Drops startup file

Accesses Microsoft Outlook profiles

Drops desktop.ini file(s)

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

outlook_office_path

Interacts with shadow copies

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

outlook_win_path

Checks SCSI registry key(s)

Suspicious behavior: MapViewOfSection

Uses Task Scheduler COM API

Suspicious use of UnmapMainImage

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-09-23 19:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-23 19:35

Reported

2023-09-23 19:37

Platform

win7-20230831-en

Max time kernel

78s

Max time network

154s

Command Line

C:\Windows\Explorer.EXE

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2652 created 1184 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (99) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\certreq.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4E10.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5N}@sGpcO1 = "C:\\Users\\Admin\\AppData\\Local\\5N}@sGpcO1.exe" C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows\CurrentVersion\Run\5N}@sGpcO1 = "C:\\Users\\Admin\\AppData\\Local\\5N}@sGpcO1.exe" C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-607259312-1573743425-2763420908-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-607259312-1573743425-2763420908-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\Common.fxh C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Algiers.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sendopts.jar C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Knox C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ndjamena C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Budapest C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Winnipeg.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Berlin.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\HideJoin.html.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_zh_CN.jar C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\7-Zip\Lang\nb.txt.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ast.txt C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Australia\Hobart.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tijuana.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Amman.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Microsoft Games\Hearts\de-DE\Hearts.exe.mui.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2iexp.dll C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.registry_1.1.300.v20130402-1529.jar C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Tahiti.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Microsoft Games\FreeCell\desktop.ini.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\ChkrRes.dll.mui C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\shvlzm.exe.mui C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_ja.jar C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\ChkrRes.dll.mui C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\kk.txt C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.id[20671345-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\wTy.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\wTy.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\wTy.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\wTy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\wTy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\wTy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\wTy.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\wTy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4E10.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1028 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 1028 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 1028 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 1028 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 1028 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 1028 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 1028 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 1028 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 1028 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 2652 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Windows\system32\certreq.exe
PID 2652 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Windows\system32\certreq.exe
PID 2652 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Windows\system32\certreq.exe
PID 2652 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Windows\system32\certreq.exe
PID 2652 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Windows\system32\certreq.exe
PID 2652 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Windows\system32\certreq.exe
PID 2852 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2852 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2852 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2852 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2852 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2852 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2852 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2852 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2852 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2852 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2852 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2816 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Microsoft\wTy.exe C:\Users\Admin\AppData\Local\Microsoft\wTy.exe
PID 2816 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Microsoft\wTy.exe C:\Users\Admin\AppData\Local\Microsoft\wTy.exe
PID 2816 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Microsoft\wTy.exe C:\Users\Admin\AppData\Local\Microsoft\wTy.exe
PID 2816 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Microsoft\wTy.exe C:\Users\Admin\AppData\Local\Microsoft\wTy.exe
PID 2816 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Microsoft\wTy.exe C:\Users\Admin\AppData\Local\Microsoft\wTy.exe
PID 2816 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Microsoft\wTy.exe C:\Users\Admin\AppData\Local\Microsoft\wTy.exe
PID 2816 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Microsoft\wTy.exe C:\Users\Admin\AppData\Local\Microsoft\wTy.exe
PID 2820 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2820 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2820 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2820 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2820 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2820 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2820 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2820 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2820 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2820 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 2820 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe
PID 3056 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Windows\system32\cmd.exe
PID 3056 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Windows\system32\cmd.exe
PID 3056 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Windows\system32\cmd.exe
PID 3056 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Windows\system32\cmd.exe
PID 3056 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Windows\system32\cmd.exe
PID 3056 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Windows\system32\cmd.exe
PID 3056 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Windows\system32\cmd.exe
PID 3056 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe C:\Windows\system32\cmd.exe
PID 1652 wrote to memory of 2072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1652 wrote to memory of 2072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1652 wrote to memory of 2072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1540 wrote to memory of 2260 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1540 wrote to memory of 2260 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1540 wrote to memory of 2260 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1540 wrote to memory of 980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1540 wrote to memory of 980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1540 wrote to memory of 980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1184 wrote to memory of 1564 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\4E10.exe
PID 1184 wrote to memory of 1564 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\4E10.exe
PID 1184 wrote to memory of 1564 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\4E10.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe

"C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe"

C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe

C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe

"C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe"

C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe

C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe

C:\Users\Admin\AppData\Local\Microsoft\wTy.exe

"C:\Users\Admin\AppData\Local\Microsoft\wTy.exe"

C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe

"C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe"

C:\Users\Admin\AppData\Local\Microsoft\wTy.exe

C:\Users\Admin\AppData\Local\Microsoft\wTy.exe

C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe

C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Users\Admin\AppData\Local\Temp\4E10.exe

C:\Users\Admin\AppData\Local\Temp\4E10.exe

C:\Users\Admin\AppData\Local\Temp\4E10.exe

C:\Users\Admin\AppData\Local\Temp\4E10.exe

C:\Users\Admin\AppData\Local\Temp\648E.exe

C:\Users\Admin\AppData\Local\Temp\648E.exe

C:\Users\Admin\AppData\Local\Temp\81B8.exe

C:\Users\Admin\AppData\Local\Temp\81B8.exe

C:\Users\Admin\AppData\Local\Temp\8773.exe

C:\Users\Admin\AppData\Local\Temp\8773.exe

C:\Users\Admin\AppData\Local\Temp\900C.exe

C:\Users\Admin\AppData\Local\Temp\900C.exe

C:\Users\Admin\AppData\Local\Temp\648E.exe

"C:\Users\Admin\AppData\Local\Temp\648E.exe"

C:\Users\Admin\AppData\Local\Temp\A7C0.exe

C:\Users\Admin\AppData\Local\Temp\A7C0.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\EE93.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\EE93.tmp\svchost.exe -debug

Network

Country Destination Domain Proto
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 mksad917.xyz udp
DE 193.31.28.70:80 mksad917.xyz tcp
US 8.8.8.8:53 cdn1.frocdn.ch udp
US 188.114.96.0:443 cdn1.frocdn.ch tcp
US 8.8.8.8:53 qu.ax udp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
US 8.8.8.8:53 apps.identrust.com udp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
NL 88.221.25.153:80 apps.identrust.com tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp
IL 91.226.72.136:443 qu.ax tcp

Files

memory/1028-0-0x0000000000350000-0x00000000003D6000-memory.dmp

memory/1028-1-0x0000000074980000-0x000000007506E000-memory.dmp

memory/1028-2-0x00000000041F0000-0x0000000004268000-memory.dmp

memory/1028-3-0x0000000004790000-0x00000000047D0000-memory.dmp

memory/1028-4-0x0000000004690000-0x00000000046F8000-memory.dmp

memory/1028-5-0x0000000000590000-0x00000000005DC000-memory.dmp

memory/2652-7-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2652-8-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2652-6-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2652-9-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2652-12-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2652-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1028-14-0x0000000074980000-0x000000007506E000-memory.dmp

memory/2652-15-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2652-16-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2652-17-0x0000000000100000-0x0000000000107000-memory.dmp

memory/2652-18-0x00000000021A0000-0x00000000025A0000-memory.dmp

memory/2652-20-0x00000000021A0000-0x00000000025A0000-memory.dmp

memory/2652-19-0x00000000021A0000-0x00000000025A0000-memory.dmp

memory/2652-21-0x00000000021A0000-0x00000000025A0000-memory.dmp

memory/1340-22-0x00000000000E0000-0x00000000000E3000-memory.dmp

memory/2652-24-0x0000000000170000-0x00000000001A6000-memory.dmp

memory/2652-23-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2652-31-0x00000000021A0000-0x00000000025A0000-memory.dmp

memory/2652-30-0x0000000000170000-0x00000000001A6000-memory.dmp

memory/2652-32-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2652-33-0x00000000021A0000-0x00000000025A0000-memory.dmp

memory/1340-34-0x00000000000E0000-0x00000000000E3000-memory.dmp

memory/1340-36-0x00000000002B0000-0x00000000002B7000-memory.dmp

memory/1340-37-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/1340-38-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/1340-39-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/1340-40-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/1340-42-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/1340-44-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/1340-45-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/1340-46-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/1340-47-0x0000000077990000-0x0000000077B39000-memory.dmp

memory/1340-48-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/1340-49-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/1340-50-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/1340-51-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/1340-52-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/2852-56-0x0000000001320000-0x00000000014D2000-memory.dmp

memory/2852-57-0x0000000074290000-0x000000007497E000-memory.dmp

memory/2852-59-0x0000000000AD0000-0x0000000000B04000-memory.dmp

memory/1340-60-0x0000000077990000-0x0000000077B39000-memory.dmp

memory/2852-58-0x00000000006D0000-0x0000000000716000-memory.dmp

memory/3056-62-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2852-61-0x00000000049C0000-0x0000000004A00000-memory.dmp

memory/3056-64-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3056-66-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3056-68-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3056-69-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3056-70-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3056-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3056-73-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2852-76-0x0000000074290000-0x000000007497E000-memory.dmp

memory/3056-77-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Microsoft\wTy.exe

MD5 1611ddc5ba7af4c5f4c247c178ccdbb3
SHA1 4be33b42d1def3b0fc027b72efe233b6e05007e5
SHA256 c40a4e9ac9b6cefbfdabd59a314fae01b7fcd0b91e0a7cd8b02afd105a234eb0
SHA512 6d1319e6f8db72bc50e8b77ac470ac1b42e2f34455604b651d1c50f14ad8464cf98feafb4b86f416155980aff9a353a3b6edac944cefa73ebc61b63f5718e0e5

C:\Users\Admin\AppData\Local\Microsoft\wTy.exe

MD5 1611ddc5ba7af4c5f4c247c178ccdbb3
SHA1 4be33b42d1def3b0fc027b72efe233b6e05007e5
SHA256 c40a4e9ac9b6cefbfdabd59a314fae01b7fcd0b91e0a7cd8b02afd105a234eb0
SHA512 6d1319e6f8db72bc50e8b77ac470ac1b42e2f34455604b651d1c50f14ad8464cf98feafb4b86f416155980aff9a353a3b6edac944cefa73ebc61b63f5718e0e5

memory/3056-82-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2816-81-0x0000000001240000-0x00000000013EE000-memory.dmp

memory/2816-84-0x00000000004E0000-0x0000000000512000-memory.dmp

memory/2816-83-0x0000000000380000-0x00000000003C4000-memory.dmp

memory/2816-86-0x0000000004A60000-0x0000000004AA0000-memory.dmp

memory/2816-85-0x0000000074290000-0x000000007497E000-memory.dmp

memory/2788-87-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2788-90-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/2820-92-0x0000000074290000-0x000000007497E000-memory.dmp

memory/2788-93-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2820-95-0x00000000049A0000-0x00000000049E0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\wTy.exe

MD5 1611ddc5ba7af4c5f4c247c178ccdbb3
SHA1 4be33b42d1def3b0fc027b72efe233b6e05007e5
SHA256 c40a4e9ac9b6cefbfdabd59a314fae01b7fcd0b91e0a7cd8b02afd105a234eb0
SHA512 6d1319e6f8db72bc50e8b77ac470ac1b42e2f34455604b651d1c50f14ad8464cf98feafb4b86f416155980aff9a353a3b6edac944cefa73ebc61b63f5718e0e5

memory/2788-99-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2788-96-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2816-98-0x0000000074290000-0x000000007497E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\5N}@sGpcO1.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/2820-117-0x0000000074290000-0x000000007497E000-memory.dmp

memory/2656-119-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1340-120-0x00000000002B0000-0x00000000002B2000-memory.dmp

memory/1340-121-0x0000000077990000-0x0000000077B39000-memory.dmp

memory/2788-152-0x0000000000400000-0x000000000040B000-memory.dmp

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[20671345-3483].[[email protected]].8base

MD5 6612e395ff47a52118f9da518355e215
SHA1 078787c316f5153803131384c62c25c56d088310
SHA256 1a633d862844237000feedfb2db1ba0a29e87ed79518edffaa8d12a33d478554
SHA512 995e2318db860d250eb27ff345f34001f58d519d65b542cbbc8c0ef3b333cb434756c14e29d1914b59c9f98a6400fc91c2daafc6d4fbf116d9814e32ed560ae1

C:\Users\Admin\AppData\Local\Temp\4E10.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/1564-2429-0x00000000001B0000-0x0000000000362000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4E10.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Temp\4E10.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/1564-2515-0x00000000004F0000-0x0000000000536000-memory.dmp

memory/1564-2513-0x00000000745F0000-0x0000000074CDE000-memory.dmp

memory/1564-2516-0x00000000049F0000-0x0000000004A30000-memory.dmp

\Users\Admin\AppData\Local\Temp\4E10.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/1564-2973-0x00000000745F0000-0x0000000074CDE000-memory.dmp

memory/2772-2977-0x0000000000401000-0x000000000040A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4E10.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Temp\648E.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\648E.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/1964-3052-0x00000000736F0000-0x0000000073DDE000-memory.dmp

memory/1964-3045-0x0000000000840000-0x00000000008BC000-memory.dmp

memory/1964-3205-0x0000000004210000-0x0000000004250000-memory.dmp

memory/1964-3224-0x00000000006C0000-0x0000000000702000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tar7BFA.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\Local\Temp\Cab7BD8.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

memory/1608-3539-0x00000000736F0000-0x0000000073DDE000-memory.dmp

memory/1608-3538-0x0000000000360000-0x0000000000374000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\81B8.exe

MD5 5f0bbf0b4ce5fa0bca57f1230e660dff
SHA1 529e438c21899eff993c0871ce07aff037d7f10d
SHA256 a4c58de9ff779e2b5c28d35dde1884891ab419e909e42c5a164ea576d8348e6d
SHA512 ddede174b3aac4bbf434e1d61da8fa858b4bde11850a75b113376dccb7356f054a9fb696f498cb01c040cec33bb03d75c8c7b2787d46fc33569aeb753ee16131

C:\Users\Admin\AppData\Local\Temp\81B8.exe

MD5 5f0bbf0b4ce5fa0bca57f1230e660dff
SHA1 529e438c21899eff993c0871ce07aff037d7f10d
SHA256 a4c58de9ff779e2b5c28d35dde1884891ab419e909e42c5a164ea576d8348e6d
SHA512 ddede174b3aac4bbf434e1d61da8fa858b4bde11850a75b113376dccb7356f054a9fb696f498cb01c040cec33bb03d75c8c7b2787d46fc33569aeb753ee16131

memory/1608-3540-0x00000000049B0000-0x00000000049F0000-memory.dmp

memory/1964-3675-0x00000000736F0000-0x0000000073DDE000-memory.dmp

memory/1512-3696-0x0000000000910000-0x0000000000924000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8773.exe

MD5 4345b942eb187e2b867a6e9524d166e0
SHA1 1814c6a4205852069bbaaf9c8bd2809842d52548
SHA256 0b80d7aea7acb5d4bd7e6dbfabeaf5529faec78ff5b29fc525edc2c8bf7e537c
SHA512 85f5ecafcb711af6ace4ddb11ca3a8e8d2a4799ba07d258bb731d55dc36614139db760aeea6e1f1d3674bb045230ba9d247c13d895a7f3f85ea26967788a87d6

C:\Users\Admin\AppData\Local\Temp\8773.exe

MD5 4345b942eb187e2b867a6e9524d166e0
SHA1 1814c6a4205852069bbaaf9c8bd2809842d52548
SHA256 0b80d7aea7acb5d4bd7e6dbfabeaf5529faec78ff5b29fc525edc2c8bf7e537c
SHA512 85f5ecafcb711af6ace4ddb11ca3a8e8d2a4799ba07d258bb731d55dc36614139db760aeea6e1f1d3674bb045230ba9d247c13d895a7f3f85ea26967788a87d6

memory/1512-3748-0x00000000736F0000-0x0000000073DDE000-memory.dmp

memory/1512-3750-0x0000000004A50000-0x0000000004A90000-memory.dmp

memory/1964-3795-0x0000000004210000-0x0000000004250000-memory.dmp

memory/1076-3776-0x0000000000980000-0x0000000000994000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\900C.exe

MD5 4345b942eb187e2b867a6e9524d166e0
SHA1 1814c6a4205852069bbaaf9c8bd2809842d52548
SHA256 0b80d7aea7acb5d4bd7e6dbfabeaf5529faec78ff5b29fc525edc2c8bf7e537c
SHA512 85f5ecafcb711af6ace4ddb11ca3a8e8d2a4799ba07d258bb731d55dc36614139db760aeea6e1f1d3674bb045230ba9d247c13d895a7f3f85ea26967788a87d6

memory/1076-3799-0x00000000736F0000-0x0000000073DDE000-memory.dmp

memory/1076-3800-0x0000000004960000-0x00000000049A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\900C.exe

MD5 4345b942eb187e2b867a6e9524d166e0
SHA1 1814c6a4205852069bbaaf9c8bd2809842d52548
SHA256 0b80d7aea7acb5d4bd7e6dbfabeaf5529faec78ff5b29fc525edc2c8bf7e537c
SHA512 85f5ecafcb711af6ace4ddb11ca3a8e8d2a4799ba07d258bb731d55dc36614139db760aeea6e1f1d3674bb045230ba9d247c13d895a7f3f85ea26967788a87d6

C:\Users\Admin\AppData\Local\Temp\900C.exe

MD5 4345b942eb187e2b867a6e9524d166e0
SHA1 1814c6a4205852069bbaaf9c8bd2809842d52548
SHA256 0b80d7aea7acb5d4bd7e6dbfabeaf5529faec78ff5b29fc525edc2c8bf7e537c
SHA512 85f5ecafcb711af6ace4ddb11ca3a8e8d2a4799ba07d258bb731d55dc36614139db760aeea6e1f1d3674bb045230ba9d247c13d895a7f3f85ea26967788a87d6

memory/1608-3939-0x00000000736F0000-0x0000000073DDE000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cd08e47e5c492d0a1dddfe6f302359b2
SHA1 762d2618883af565d18bac79a653b5ab23cfb696
SHA256 28c1454081dac0454d61dca6d9ebaee0c9efe2f9d20e5bf6127e579fe67d44e5
SHA512 154aa01c73c5cc12d7bab75d303c21a99f5a2eeac8a87238cbd7bd3a51b1bbf9a91d27a50c836d5509f101969d6ee8a0a4b8b141c9e36dc695fb20e0f88cc3e2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 73b8d6aaabfcdc1438a80af4ccbdfeed
SHA1 086038e9fc814e6a8d7ab892d92ccb04bb0be458
SHA256 5e0effad863551afc12267de281332fc4619922be69ec1a0d77223e1db6c67b5
SHA512 4c6125109bfde534f2b7247c8d140a8f7699368c00ab7fc670e7bd369836291865dc5a68ee21b52f6ead235de869b8eec6ea05a2f5453aa0492fe26b247e9066

memory/1608-4384-0x00000000049B0000-0x00000000049F0000-memory.dmp

memory/1964-4391-0x0000000000450000-0x000000000046A000-memory.dmp

\Users\Admin\AppData\Local\Temp\648E.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\A7C0.exe

MD5 400261992d812b24ecd3bfe79700443c
SHA1 f4f0d341cc860f046b2713939c70da32944f7eda
SHA256 222a5af34881bb68ffc370491a0f8d67b550cd368c49927715946365bbe8038f
SHA512 ed25f5d636658f629625614a95d4bc7a999b10cb2689c38159afa5ff24afd5136119500d00ebe83d880702f9b8e560fb570d92199f56e865eccca9695b8582f9

C:\Users\Admin\AppData\Local\Temp\A7C0.exe

MD5 400261992d812b24ecd3bfe79700443c
SHA1 f4f0d341cc860f046b2713939c70da32944f7eda
SHA256 222a5af34881bb68ffc370491a0f8d67b550cd368c49927715946365bbe8038f
SHA512 ed25f5d636658f629625614a95d4bc7a999b10cb2689c38159afa5ff24afd5136119500d00ebe83d880702f9b8e560fb570d92199f56e865eccca9695b8582f9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2hawuouz.default-release\cookies.sqlite.id[20671345-3483].[[email protected]].8base

MD5 85382e6a36b2165983aae333459511ce
SHA1 bbc2df8d5db98c82178a942104c2fb7ba7a1a5bf
SHA256 e034741dcaae389020ecfbf9498a75b7a4ac4875f0fc5bddc84ebd25cf17cf81
SHA512 a4fa4426babfc02b84cd37ab336be94b56f7d8c22f596b66dc5f144529a67f2ae8470e4885de01b2491b99ad6a99254582781bad3ecac0ec82278f8f402063e6

C:\Users\Admin\AppData\Local\Temp\EE93.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\EE93.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

\Users\Admin\AppData\Local\Temp\EE93.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

\Users\Admin\AppData\Local\Temp\EE93.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\EE93.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\648E.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Roaming\dicaghb

MD5 1611ddc5ba7af4c5f4c247c178ccdbb3
SHA1 4be33b42d1def3b0fc027b72efe233b6e05007e5
SHA256 c40a4e9ac9b6cefbfdabd59a314fae01b7fcd0b91e0a7cd8b02afd105a234eb0
SHA512 6d1319e6f8db72bc50e8b77ac470ac1b42e2f34455604b651d1c50f14ad8464cf98feafb4b86f416155980aff9a353a3b6edac944cefa73ebc61b63f5718e0e5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

MD5 1e68d57a58cd9cc570b04987964bf401
SHA1 dba4a80dec352ea0e456f5a22eebe7fcc4587c6e
SHA256 7a47a7282da5c54fcc20368d23a5fe6a38ea1154ec60882e2c2ce52e29c198fa
SHA512 4f013359ebd02e79ae574a02d85f99b7812eeed143c291772749cf2223369aaa5430e4e378465b422ed9be81557c20b486d582d11a279cc1f68cb314c7cfc767

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1b6f9b0821f6e250d05666431791c8e5
SHA1 0f165827229b795bcf6ff12404e1756ff240b2f9
SHA256 5b4e54e5d8872831dde28e0407bb27042719229c8064a655710e03a5e5dd5d7c
SHA512 ccb255503cc95966630d8f8992d7c165aacec8642472b1a29dc76844f4dc1597d7578c5fe7250236ba45b2088bdce3166b2ff21876f60d75c057b4e51e4512a3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

MD5 d4ae187b4574036c2d76b6df8a8c1a30
SHA1 b06f409fa14bab33cbaf4a37811b8740b624d9e5
SHA256 a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7
SHA512 1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

C:\Users\Admin\AppData\Roaming\huihavc

MD5 1c8bb7fe6ef0fd245fdd6db968d070e4
SHA1 0b88c7391fa6d09332955bdc1aa31d7926e53f08
SHA256 351365c85bf9a211dc7d611737afdf0b84778fd4c4f53389f319a110d4d0d455
SHA512 b3b4d6694c24f7b377f2bceeb10e353c803e0f382661c22512e93ecd163053e95f50e09895b8998aef0fecddad8ef9d21c03a701a475766dfb38c0f7c243061e

C:\Users\Admin\Desktop\RenameRestart.mpg.id[20671345-3483].[[email protected]].8base

MD5 258b31c5b067fbc5edebbd3991cc0c38
SHA1 552e186d5d15f147e11efacfc049a718ffcef14f
SHA256 7e6dba8bdf3a35f025e9e738aa1a4ba74dbb65738c1536b2d42c6c74136e5ae3
SHA512 0322763fc3c3f42404ed2ec745cd8d4ad3f0630e05e0dd6e22fca02627d9aeae2a1f140de77a6bbea60f312e90c395c4e977f0f7ace44633c2fe1f590bbd9ded

C:\Users\Admin\Desktop\BlockMount.zip.id[20671345-3483].[[email protected]].8base

MD5 a18ed3e22249a6e33b2b9f65f3899ea5
SHA1 7282001e95995056c08ad9a39af93922173158e8
SHA256 323834ff0ef44084f0107fc71962fc208a71ce4ab7e0c2d3945150b23a6bbef9
SHA512 d177b85a329570aa6f344fcf352f236cdec21169056827973e0b4b9edcdc1cefcd6fba07bcee7efce1f0e7a6ffb3b91fb94a1a89b4fa04ae692298476635de5e

C:\Users\Admin\Desktop\ConfirmSearch.au.id[20671345-3483].[[email protected]].8base

MD5 d2376bf4fa54d31663bc652aecb85705
SHA1 7441d455b31701902de8e61cf912cb7e04d2b531
SHA256 3203accee6cc3be291e6ac99c1ae519f706d39ff46f10e8182ecacd3ad26f4f1
SHA512 25496e25e4a41ac9f14a9800c4ca8fe347e6038a35d84e660e34ee93c22a2dd4550345a1e0aa38660b81997297e61ddc36f5d7b63e67270431019c5c7e627ed4

C:\Users\Admin\Desktop\ConvertFromRegister.mpeg.id[20671345-3483].[[email protected]].8base

MD5 5f226e1f220304378418cb3ea7951d2a
SHA1 e7f868cba20720e5ab989d21b0f7f2bf6682c1dc
SHA256 2f56ab128741e9df96cc51c83bb138ba9db099c9b6bcedd2828fec42fdeed95d
SHA512 9fbad61bf2648168bae71368a4b2701559caa4987d6fa4e27aa7733f6a8067c4de3c568844487866dcf82a1f63460a5e5201aee66dec8542f262b58f1f706edf

C:\Users\Admin\Desktop\ConvertToConvert.001.id[20671345-3483].[[email protected]].8base

MD5 cf841562a2c3ee5b5556c5edc05de6c4
SHA1 40bc812b63eec09ccb7daa1ff0923618e4577211
SHA256 3dc37bced6c6b22a043b0a0ab1694801738bb07a5ebaa464c8827f6565983466
SHA512 bf3f804789c2d61b285d1d489f5516bfaf13383855cc17280ddfa908fbdc002c65a29d25ced4fb62422d7ba775f2ea86123585628495b496cb7063103d993997

C:\Users\Admin\Desktop\CopyGet.ico.id[20671345-3483].[[email protected]].8base

MD5 dd488f3d444605ba032ba038089c3dca
SHA1 2ff0d55170404c04ea65accc71a54a5f833d8ff2
SHA256 681d884bb21105fdcabe00157b2ca8730c97ed26116d9540e06fef996101dce9
SHA512 116e18b527ec358364b82bca247ded2fe34964019262975eaad545943cfb8cfe1122a4e03378ae76cc75bfa9b7051b1646a0422acaafd4e4f25d6ec3926e36e8

C:\Users\Admin\Desktop\DebugClose.pub.id[20671345-3483].[[email protected]].8base

MD5 d56b863451b23a0e597e8b834b4de858
SHA1 626cad31b2a49b7ddbbcc06e4c318e4ab8740ddc
SHA256 04dc5faf069fe9c873ab2c211025593341265094046a1f6f7141ddd6d2061ed1
SHA512 10359fd34f3f919be36da6b5e619c597dcb53edc94390f374b501d240e47395f198eeb91e341a7d997b66c39971002f6d2e11c38edf275300e0fcd26653dcdf9

C:\Users\Admin\Desktop\DebugMount.fon.id[20671345-3483].[[email protected]].8base

MD5 53c480b2bcd86413853bc1325223bbee
SHA1 f7814ca2e72bf882b7046c7c5548500885ae9056
SHA256 6082c1bf9e394f17707e9ab0763161ddeb19e073f526aa0738b0b6b3043cb24c
SHA512 f9cdfcdab831e1d1663301df0ee78dbc24ddef43af952c6c387c618abf6c8c11ca6f0364315bfdd4cd42bb6b861d1da9e1312068a7994c7a0f0517fb9f3a2e83

C:\Users\Admin\Desktop\ExitAssert.xht.id[20671345-3483].[[email protected]].8base

MD5 6f4837fe220693f95763d21bb6c0e1ea
SHA1 af3faac5f43d63d7061c5fde09dfaf423af09c5c
SHA256 173eee5c2259ddca6319f04c0eb79ec5aaa1f728fe45ff5755cd921817ca575b
SHA512 91481a55302d0814ce1e7fa842a5a12c4bfaa8dca10a6fd9e4c46bb5aafba10c7e616a0f70cd2cc69843fb83bcf90951fbfdff613af210c896f86e18de3d9376

C:\Users\Admin\Desktop\GetResolve.vdw.id[20671345-3483].[[email protected]].8base

MD5 55d0bcdc45a18afa60ca295f3317e9df
SHA1 f8b7c13c2c2d7a19936b060983aac5fa100d6f50
SHA256 6120fac3915d7c8894de70f0f11460da3042c32842eee3ddc67e520d240a4a94
SHA512 5dc9da95903808be4f819c8553e1051b82e8a5ac25615f53f9c435d4ca2570cd74ede02bce8c5425f24a890485e88f52a635fcca0288a4e03e6b5f842f3d2e9f

C:\Users\Admin\Desktop\GetShow.xlsb.id[20671345-3483].[[email protected]].8base

MD5 fcd05e3b42d5532f9c64deca3832fa6f
SHA1 1ee8f3fd1561da7bad4da903ed641037349fc575
SHA256 674aa7160e24dfcc5942f20015c46e0d967dbb4559cd13a727203b53bb7db257
SHA512 0db0c277da409a750153e1b66e5cf2349cfbd2d68b5bbded1ad3aee5af855e3217e4d906cfc787fbed205d8eb0d1e37a4230852eed6ba0d3231136ad466420e7

C:\Users\Admin\Desktop\GrantUnpublish.vsdm.id[20671345-3483].[[email protected]].8base

MD5 bf7d7b381997ec7a6201f1c65adae25d
SHA1 c2f0cf8a04a26fff0034a350dd3f47c2c9e72d3f
SHA256 5e7fc0b807efafcc33adabde386d22d208c2ba2fedb292ebd6d4ad5e85612546
SHA512 a8f1c8238ea3da656e59e1a5dcfc92be8e5ea6f32c591c9378a54c43a317f2e85f39a0811cea5cbdad554342f8f7b7b06bb822b5d9adb2ea39a05fcc431cdea4

C:\Users\Admin\Desktop\HideStart.hta.id[20671345-3483].[[email protected]].8base

MD5 bd586f418b856afea88e98829556b1e9
SHA1 eb1e4252154968eb0f5e18aebe6fe5b61be71aca
SHA256 a912018044d0c0338ac297963c5bd997aee7e2b9ad529392247a9a2c6b32a151
SHA512 84bc38f565e78e467b24ee5231ef7795535c248d666ac1161396930308962aed8f663449ce41c396629c41e7fc502e54b76d345c3dd7c87242ff0b819fb52aef

C:\Users\Admin\Desktop\InitializeCopy.rtf.id[20671345-3483].[[email protected]].8base

MD5 bfe1cc29827c4521191ea8171c040a7b
SHA1 d5a88242d0c047ff1ec35a45d91d119631dd6e1e
SHA256 84d409cde438b160cc44280e7653fabd7eac53a83b52e059ae84264153a0bb48
SHA512 4922fec8453a2538ad2724d5237bb2356a26e32874aa9f0f91e9cbee6deb4ce7aa8c2432e83e400d4156e12992194abe18a8ee9025dffdb32ac4ff4d5e78812c

C:\Users\Admin\Desktop\InitializeOpen.xhtml.id[20671345-3483].[[email protected]].8base

MD5 35e6aa137640c0e52b0856ee095a64a6
SHA1 fc995fa24adf3f76bfc59b9690e9369b3474e430
SHA256 067ac4867907f7793d15fd8c8cb9b3c4c9cc37b5db478dd72e0be281f54d92d0
SHA512 38f809bc3c343312c475f920cc61373c248fed23aad88c2fabeeb2c0b9f5473c52c039364b0c12c5a2c9ed12ec5e815fff755ce5a6fc4b67b73c9c70c8366402

C:\Users\Admin\Desktop\NewAssert.emz.id[20671345-3483].[[email protected]].8base

MD5 fdd7f3c33bd33ff600abe0d3a4a3d9ae
SHA1 a023a9fd73860c922bca5feca01df53e90ce9df2
SHA256 053fd0a33e216541ccc888fa9f48038eb410d3f977ae5f9943c792120cb0c40b
SHA512 f49ea2988a207892bad4c263c8a7fbf941bbb596e964298a6880464ac75a2294eb5e98eff7f8f13b2e255b9f490a9e3a8e9b8df26c1b003ae3b5ed69081daa00

C:\Users\Admin\Desktop\PopResume.scf.id[20671345-3483].[[email protected]].8base

MD5 64b0372c3d60cb3625b0f4af0bc36067
SHA1 36fe29d1271d97adc38dca1d92bac4147b38179d
SHA256 bb41d7b04748d660c4d3d8678a483303587d128178a86c9f7608ea710bcb0478
SHA512 5a26333a5367b376bc7352d7f728dd65d8310eb4cebf6842be47d6e2b5977b180bf9577416b50671b55d4ff3b0bb1b4253d6d3de5321a0ef263e5d6ee029fccd

C:\Users\Admin\Desktop\ResetRestore.temp.id[20671345-3483].[[email protected]].8base

MD5 b73fabf0eb55e5d2d530e7d424e3688c
SHA1 a5949accfe4afc4cd3e2d276e2feeac8d78ef253
SHA256 f87020212ec812fc566160bc227f1c20f252b9774885df7a196c8d377ac3cb6a
SHA512 bf1d6b1581bc4843e6b1c2961ca6f5a065d95024606f12f0702c237d1155d5c3ba46a0c1fecbadef9b9980cb168e27a371d71f7e1bb2bbf0faa39b905937b20e

C:\Users\Admin\Desktop\RevokeFormat.dot.id[20671345-3483].[[email protected]].8base

MD5 0abdea541578dc4537d6cefc5fcbef8c
SHA1 fab4d59127ac981907643d6ecdd6a88e2542ad0a
SHA256 ecff63d175bf6c727a0b0a49191ab0ca06c1eb8fce34b95a466131741ebdd07c
SHA512 28ff4d2295865a9a5b1021e09147963404af492bb5722b4dd482eff40d0fd27a80478df2798474fff03fc0d5d631a5dc78641bbfbaf7129b91499bbcc3e28972

C:\Users\Admin\Desktop\SetEnter.mht.id[20671345-3483].[[email protected]].8base

MD5 69591cb9065b19d3ccae604e11f6237b
SHA1 581118175c4c1b4bb2786f34875e8dcad34c79b8
SHA256 72746ae9da051ebbbf01ddb6ea55a34859755e3897c7fd7fd6ec73cb8d38c095
SHA512 887a5420a9cfe1519da096596a4a0610968aa5df13bbb1dc0e7b68179be16a8bfbf2d6a62364a4c714ac5da1f50996e11957c0c68be8521263ebfae61e59346c

C:\Users\Admin\Desktop\SetPing.wmf.id[20671345-3483].[[email protected]].8base

MD5 104d4334b52900adca9f2a58da1cbf09
SHA1 567ac332bf7b8262d96475c2f008aadfca515cbd
SHA256 58935fa84a5f411e76ec20cbeee85da03b744a314a1214a4de1eeab1bacc572f
SHA512 9845bb8633845d8b84da6139f6448d91bb7605d3295755154ebad64b78825aac7e9112d53bdf7171e075b96524dd200027b064db504ac9abbeab36d6f15500fa

C:\Users\Admin\Desktop\SetSearch.m4v.id[20671345-3483].[[email protected]].8base

MD5 7d02b71190803ab5293356b465ee806f
SHA1 b4e8f833c7ba5bfd6a42634983c37d81e0265e6d
SHA256 a98d338adce106594d1a4713bb08d7441a8447b6c6b8d4954a75772810e6cb1a
SHA512 610b0da9e74b0fff6861601e8418bfa8a5c034db0bbf8576aa6a68a4bdb5001ee949403e58b5b2d4ce236cbe55ea09f4d6407368936482b8710ea07ad759d6e9

C:\Users\Admin\Desktop\SuspendPush.aifc.id[20671345-3483].[[email protected]].8base

MD5 2f3705bb25144b66214b85558299c7d9
SHA1 756416bbc4efc95848ef102f8f8286b7ec2ed4e6
SHA256 152c41fd5cfff110c2c59265cdb4b45585fffdf2d4dd094fe3193ec2330c7296
SHA512 f878409620355cdfe7bd3ddac538b4a1a10ca9ee48082d3cbc0183dffd4aafca0bddc304a83116443f3c7db35654a790e53d4382e539377b54855168ae972c35

C:\Users\Admin\Desktop\UninstallMove.ppsx.id[20671345-3483].[[email protected]].8base

MD5 3ae6a92f267b1a169c5b9dcefebfbc90
SHA1 25ba480155474c71407c0c0a921bc11747f14241
SHA256 50f86a17c42105a1971f610e8b1853b504695bfe2e5d085ce2f34c7bbde0a866
SHA512 5313b5231378d18f147165862f6ded850638e4e8c9fd1875644e5007247890836f69d182b47bde575646de78a1bc6bfab9610c275eb96c79492a80a6f8e487aa

C:\Users\Admin\Desktop\UnregisterShow.bin.id[20671345-3483].[[email protected]].8base

MD5 1de61b51f2ff2c7260e5ff625fb22547
SHA1 cf95e1cd4185ae0152e82e5fb164830938c36044
SHA256 f627cbd333f9576bab6799ffb9c3dd7d9c228c70c9f121ac22fc63fd905ce078
SHA512 6b549b9e5eafc2b3e59af4003aed9b45a3c211f2f47b8d82adb8060e0b552097db9a16a58a28e7f7d3b9cffc69dff1317b32528367c2cd716f9d6473a32d00fb

C:\Users\Admin\Desktop\WriteGroup.svg.id[20671345-3483].[[email protected]].8base

MD5 6f8548be0ed81e16d5e655c0813671ec
SHA1 44e851e0dbce390f924dcf3ea89e7711f963cc0c
SHA256 fa31fc8adfd9e5accdedfe5aee1fd2fba3b2ee29123ffd9a6f3abbdcd27192e1
SHA512 413a4df387dddfe70172f1324ca5205a362cb4dfb1cdb1659abf2651ae9c78ee74215a990272affca4e0e5d019caf1b35f5f0a3ff33a39b4d3fe3528dc5b906d

C:\Users\Admin\Desktop\WriteSave.jtx.id[20671345-3483].[[email protected]].8base

MD5 cba2fa7cfc6a0268bca3276371e0ac1a
SHA1 59737808a6146be838f28ae07445e6942df84357
SHA256 987486de110b638db0e4ae35918b4ad3ecefbb42be5489ba922b48e6521bf97f
SHA512 7d3583650f0ea47f512159ca814aba376c06d78e142f07587be030478ae1894282fa63baba6f3d5f85720af1b7c03b9ac6fba8a84802be81c9b9fe1398bf6ae2

C:\Users\Public\Desktop\VLC media player.lnk.id[20671345-3483].[[email protected]].8base

MD5 a3f127511a80fbfddc478b2213529b24
SHA1 3a61fd7a1c8cd7be027ca953f07dd957506a4ca2
SHA256 21c2566265c3f66925d24da753ddb91db09e16eac8ea637372e77790e69ad142
SHA512 95800478821a4df340e46026417be723b39d62e5705e71f2052db8ed139aa306b6caed6fc29e066ef84c177f6325555d207f5ddd45153f327202da7446119539

C:\Users\Public\Desktop\Firefox.lnk.id[20671345-3483].[[email protected]].8base

MD5 70f8d984bb703bf2a90460d6b5ede061
SHA1 655575fae48bcc553e5c93e543eecdf763259d62
SHA256 a70af5594e01521cef2a3512129cd054343f94ff2ec8c912ce1258108c08e226
SHA512 76b04818aeb12bced30f45e7b6f2f105516d7d33e32c38fa81996c94aaff2868e968239e87412ff38e42668bc770bae39bddacacf822beb2092b8844d1ac239c

C:\Users\Public\Desktop\Google Chrome.lnk.id[20671345-3483].[[email protected]].8base

MD5 b4a0bb723d9d65ccb32daf6ad52dfd95
SHA1 9d5c9c093bc09fa4d68c38989214ec0ded790830
SHA256 399091b9c36dd733cef90d9e572d23d29c355f80e7d8bc214033fed710cdfb57
SHA512 0b9afd5a6677fd4da14500ca18b326f2893bc98d5984fdfdd24b0487c2f3a5593ea02c8f90f76c26bf9d16f520eaa2d890487817c5cdabcf32f244ece234487a

Analysis: behavioral2

Detonation Overview

Submitted

2023-09-23 19:35

Reported

2023-09-23 19:37

Platform

win10v2004-20230915-en

Max time kernel

73s

Max time network

80s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 5012 created 3192 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (92) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\`aW2f[j = "C:\\Users\\Admin\\AppData\\Local\\`aW2f[j.exe" C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\`aW2f[j = "C:\\Users\\Admin\\AppData\\Local\\`aW2f[j.exe" C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1045988481-1457812719-2617974652-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1045988481-1457812719-2617974652-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-actions.jar.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2iexp.dll.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\jpeg.dll.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-awt.xml.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jre1.8.0_66\lib\management\snmp.acl.template.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\boot_ja.jar.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-text.xml C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\ij.bat C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.common_3.6.200.v20130402-1505.jar C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_ja_4.4.0.v20140623020002.jar.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\cmm\PYCC.pf C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\flavormap.properties C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\7-Zip\Lang\ne.txt.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_fr.properties C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\7-Zip\Lang\si.txt.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.id[C033CA36-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-awt.jar C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\[1m.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\[1m.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\[1m.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\[1m.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\[1m.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\[1m.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\[1m.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\[1m.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6944.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3856 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 3856 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 3856 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 3856 wrote to memory of 3412 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 3856 wrote to memory of 3412 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 3856 wrote to memory of 3412 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 3856 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 3856 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 3856 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 3856 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 3856 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 3856 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 3856 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 3856 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
PID 5012 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Windows\system32\certreq.exe
PID 5012 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Windows\system32\certreq.exe
PID 5012 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Windows\system32\certreq.exe
PID 5012 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe C:\Windows\system32\certreq.exe
PID 1744 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 1744 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 1744 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 1744 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 1744 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 1744 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 1744 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 1744 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 1744 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 1744 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 3176 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 3176 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 3176 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 3176 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 3176 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 3176 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 3176 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 3176 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 3176 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 3176 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe
PID 4840 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Microsoft\[1m.exe C:\Users\Admin\AppData\Local\Microsoft\[1m.exe
PID 4840 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Microsoft\[1m.exe C:\Users\Admin\AppData\Local\Microsoft\[1m.exe
PID 4840 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Microsoft\[1m.exe C:\Users\Admin\AppData\Local\Microsoft\[1m.exe
PID 4840 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Microsoft\[1m.exe C:\Users\Admin\AppData\Local\Microsoft\[1m.exe
PID 4840 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Microsoft\[1m.exe C:\Users\Admin\AppData\Local\Microsoft\[1m.exe
PID 4840 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Microsoft\[1m.exe C:\Users\Admin\AppData\Local\Microsoft\[1m.exe
PID 3484 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Windows\system32\cmd.exe
PID 3484 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Windows\system32\cmd.exe
PID 3484 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Windows\system32\cmd.exe
PID 3484 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe C:\Windows\system32\cmd.exe
PID 1976 wrote to memory of 3528 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1976 wrote to memory of 3528 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4184 wrote to memory of 3872 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4184 wrote to memory of 3872 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4184 wrote to memory of 4912 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4184 wrote to memory of 4912 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1976 wrote to memory of 4748 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1976 wrote to memory of 4748 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4184 wrote to memory of 2428 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4184 wrote to memory of 2428 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4184 wrote to memory of 276 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4184 wrote to memory of 276 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4184 wrote to memory of 4116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 4184 wrote to memory of 4116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3192 wrote to memory of 1364 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\6944.exe
PID 3192 wrote to memory of 1364 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\6944.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe

"C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe"

C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe

C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe

C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe

C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe

C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe

C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe

"C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe"

C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe

C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe

C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe

"C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe"

C:\Users\Admin\AppData\Local\Microsoft\[1m.exe

"C:\Users\Admin\AppData\Local\Microsoft\[1m.exe"

C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe

C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe

C:\Users\Admin\AppData\Local\Microsoft\[1m.exe

C:\Users\Admin\AppData\Local\Microsoft\[1m.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Users\Admin\AppData\Local\Temp\6944.exe

C:\Users\Admin\AppData\Local\Temp\6944.exe

C:\Users\Admin\AppData\Local\Temp\6C14.exe

C:\Users\Admin\AppData\Local\Temp\6C14.exe

C:\Users\Admin\AppData\Local\Temp\6944.exe

C:\Users\Admin\AppData\Local\Temp\6944.exe

C:\Users\Admin\AppData\Local\Temp\6F9F.exe

C:\Users\Admin\AppData\Local\Temp\6F9F.exe

C:\Users\Admin\AppData\Roaming\ujtaddt

C:\Users\Admin\AppData\Roaming\ujtaddt

C:\Users\Admin\AppData\Local\Temp\7F5F.exe

C:\Users\Admin\AppData\Local\Temp\7F5F.exe

C:\Users\Admin\AppData\Roaming\ujtaddt

C:\Users\Admin\AppData\Roaming\ujtaddt

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 254.109.26.67.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 198.1.85.104.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 61.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 126.178.238.8.in-addr.arpa udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 mksad917.xyz udp
DE 193.31.28.70:80 mksad917.xyz tcp
US 8.8.8.8:53 120.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 70.28.31.193.in-addr.arpa udp
US 8.8.8.8:53 cdn1.frocdn.ch udp
US 188.114.97.0:443 cdn1.frocdn.ch tcp
US 8.8.8.8:53 0.97.114.188.in-addr.arpa udp

Files

memory/3856-0-0x00000000000F0000-0x0000000000176000-memory.dmp

memory/3856-1-0x00000000746B0000-0x0000000074E60000-memory.dmp

memory/3856-2-0x0000000004AD0000-0x0000000004B48000-memory.dmp

memory/3856-3-0x0000000004BF0000-0x0000000004C00000-memory.dmp

memory/3856-4-0x0000000004B50000-0x0000000004BB8000-memory.dmp

memory/3856-5-0x0000000004D00000-0x0000000004D4C000-memory.dmp

memory/3856-6-0x0000000005320000-0x00000000058C4000-memory.dmp

memory/5012-7-0x0000000000400000-0x0000000000473000-memory.dmp

memory/5012-10-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3856-11-0x00000000746B0000-0x0000000074E60000-memory.dmp

memory/5012-12-0x0000000000400000-0x0000000000473000-memory.dmp

memory/5012-13-0x0000000002E60000-0x0000000002E67000-memory.dmp

memory/5012-14-0x00000000030C0000-0x00000000034C0000-memory.dmp

memory/5012-16-0x00000000030C0000-0x00000000034C0000-memory.dmp

memory/5012-15-0x00000000030C0000-0x00000000034C0000-memory.dmp

memory/5012-17-0x00000000030C0000-0x00000000034C0000-memory.dmp

memory/2952-18-0x000001E44C810000-0x000001E44C813000-memory.dmp

memory/5012-19-0x0000000000400000-0x0000000000473000-memory.dmp

memory/5012-20-0x0000000003EC0000-0x0000000003EF6000-memory.dmp

memory/5012-26-0x0000000003EC0000-0x0000000003EF6000-memory.dmp

memory/5012-27-0x00000000030C0000-0x00000000034C0000-memory.dmp

memory/5012-28-0x0000000000400000-0x0000000000473000-memory.dmp

memory/5012-29-0x00000000030C0000-0x00000000034C0000-memory.dmp

memory/2952-30-0x000001E44C810000-0x000001E44C813000-memory.dmp

memory/2952-31-0x000001E44C9B0000-0x000001E44C9B7000-memory.dmp

memory/2952-32-0x00007FF4D8870000-0x00007FF4D899F000-memory.dmp

memory/2952-33-0x00007FF4D8870000-0x00007FF4D899F000-memory.dmp

memory/2952-34-0x00007FF4D8870000-0x00007FF4D899F000-memory.dmp

memory/2952-35-0x00007FF4D8870000-0x00007FF4D899F000-memory.dmp

memory/2952-36-0x00007FF4D8870000-0x00007FF4D899F000-memory.dmp

memory/2952-38-0x00007FF4D8870000-0x00007FF4D899F000-memory.dmp

memory/2952-40-0x00007FF4D8870000-0x00007FF4D899F000-memory.dmp

memory/2952-41-0x00007FF4D8870000-0x00007FF4D899F000-memory.dmp

memory/2952-42-0x00007FF4D8870000-0x00007FF4D899F000-memory.dmp

memory/2952-43-0x00007FFBB1010000-0x00007FFBB1205000-memory.dmp

memory/2952-44-0x00007FF4D8870000-0x00007FF4D899F000-memory.dmp

memory/2952-45-0x00007FF4D8870000-0x00007FF4D899F000-memory.dmp

memory/2952-46-0x00007FF4D8870000-0x00007FF4D899F000-memory.dmp

memory/2952-47-0x00007FF4D8870000-0x00007FF4D899F000-memory.dmp

memory/2952-48-0x00007FF4D8870000-0x00007FF4D899F000-memory.dmp

memory/2952-49-0x00007FFBB1010000-0x00007FFBB1205000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/1744-53-0x0000000000040000-0x00000000001F2000-memory.dmp

memory/1744-54-0x00000000746B0000-0x0000000074E60000-memory.dmp

memory/1744-55-0x0000000004B20000-0x0000000004B66000-memory.dmp

memory/1744-56-0x0000000004C30000-0x0000000004C40000-memory.dmp

memory/1744-57-0x0000000004B90000-0x0000000004BC4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/3484-58-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1744-63-0x00000000746B0000-0x0000000074E60000-memory.dmp

memory/3484-62-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3484-64-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\`aW2f[j.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

C:\Users\Admin\AppData\Local\Microsoft\[1m.exe

MD5 1611ddc5ba7af4c5f4c247c178ccdbb3
SHA1 4be33b42d1def3b0fc027b72efe233b6e05007e5
SHA256 c40a4e9ac9b6cefbfdabd59a314fae01b7fcd0b91e0a7cd8b02afd105a234eb0
SHA512 6d1319e6f8db72bc50e8b77ac470ac1b42e2f34455604b651d1c50f14ad8464cf98feafb4b86f416155980aff9a353a3b6edac944cefa73ebc61b63f5718e0e5

memory/3176-68-0x0000000074750000-0x0000000074F00000-memory.dmp

memory/3176-70-0x00000000053F0000-0x0000000005400000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\[1m.exe

MD5 1611ddc5ba7af4c5f4c247c178ccdbb3
SHA1 4be33b42d1def3b0fc027b72efe233b6e05007e5
SHA256 c40a4e9ac9b6cefbfdabd59a314fae01b7fcd0b91e0a7cd8b02afd105a234eb0
SHA512 6d1319e6f8db72bc50e8b77ac470ac1b42e2f34455604b651d1c50f14ad8464cf98feafb4b86f416155980aff9a353a3b6edac944cefa73ebc61b63f5718e0e5

memory/4840-72-0x0000000000940000-0x0000000000AEE000-memory.dmp

memory/4840-73-0x0000000074750000-0x0000000074F00000-memory.dmp

memory/4840-74-0x0000000005430000-0x0000000005474000-memory.dmp

memory/4840-76-0x00000000055B0000-0x00000000055C0000-memory.dmp

memory/4840-75-0x0000000005480000-0x00000000054B2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\`aW2f[j.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/3176-81-0x0000000074750000-0x0000000074F00000-memory.dmp

memory/2868-83-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\[1m.exe

MD5 1611ddc5ba7af4c5f4c247c178ccdbb3
SHA1 4be33b42d1def3b0fc027b72efe233b6e05007e5
SHA256 c40a4e9ac9b6cefbfdabd59a314fae01b7fcd0b91e0a7cd8b02afd105a234eb0
SHA512 6d1319e6f8db72bc50e8b77ac470ac1b42e2f34455604b651d1c50f14ad8464cf98feafb4b86f416155980aff9a353a3b6edac944cefa73ebc61b63f5718e0e5

memory/4752-86-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4840-87-0x0000000074750000-0x0000000074F00000-memory.dmp

memory/4752-82-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3484-98-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3484-99-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3484-101-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2952-214-0x000001E44C9B0000-0x000001E44C9B5000-memory.dmp

memory/2952-219-0x00007FFBB1010000-0x00007FFBB1205000-memory.dmp

memory/3484-226-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[C033CA36-3483].[[email protected]].8base

MD5 af833e493460c37cf8d9054ecbf8152c
SHA1 336ee99ebf204068a69ea707b9d56695ec030304
SHA256 56add80b1625059dd2bec9682ad899cb4c43afdaa1cf081d9a5a0f3267ccb19c
SHA512 ee84c202a5c0ff280da0542debf14710b5ba5e26bb6c25135212cc38a46b1aea20f0b176282f4176318a63162f5e172168a9a2572b3b102c9acb8c48dd328a0f

memory/3484-220-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3484-217-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3484-259-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3484-256-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3484-216-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3484-117-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3484-104-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3484-103-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4752-361-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6944.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Temp\6944.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Temp\6944.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

memory/1364-2490-0x0000000074590000-0x0000000074D40000-memory.dmp

memory/1364-2571-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6C14.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\6C14.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/2508-2940-0x0000000074590000-0x0000000074D40000-memory.dmp

memory/2508-2939-0x00000000008C0000-0x000000000093C000-memory.dmp

memory/300-2944-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1364-2943-0x0000000074590000-0x0000000074D40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6944.exe

MD5 a6ab201ae407fbe4a5da5f20dc38412b
SHA1 b3f8caf67f36730ad87031d206db91c861980615
SHA256 9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
SHA512 eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b

C:\Users\Admin\AppData\Local\Temp\6F9F.exe

MD5 5f0bbf0b4ce5fa0bca57f1230e660dff
SHA1 529e438c21899eff993c0871ce07aff037d7f10d
SHA256 a4c58de9ff779e2b5c28d35dde1884891ab419e909e42c5a164ea576d8348e6d
SHA512 ddede174b3aac4bbf434e1d61da8fa858b4bde11850a75b113376dccb7356f054a9fb696f498cb01c040cec33bb03d75c8c7b2787d46fc33569aeb753ee16131

C:\Users\Admin\AppData\Local\Temp\6F9F.exe

MD5 5f0bbf0b4ce5fa0bca57f1230e660dff
SHA1 529e438c21899eff993c0871ce07aff037d7f10d
SHA256 a4c58de9ff779e2b5c28d35dde1884891ab419e909e42c5a164ea576d8348e6d
SHA512 ddede174b3aac4bbf434e1d61da8fa858b4bde11850a75b113376dccb7356f054a9fb696f498cb01c040cec33bb03d75c8c7b2787d46fc33569aeb753ee16131

memory/2968-2957-0x0000000000030000-0x0000000000044000-memory.dmp

memory/2968-2958-0x0000000074590000-0x0000000074D40000-memory.dmp

C:\Users\Admin\AppData\Roaming\ujtaddt

MD5 1611ddc5ba7af4c5f4c247c178ccdbb3
SHA1 4be33b42d1def3b0fc027b72efe233b6e05007e5
SHA256 c40a4e9ac9b6cefbfdabd59a314fae01b7fcd0b91e0a7cd8b02afd105a234eb0
SHA512 6d1319e6f8db72bc50e8b77ac470ac1b42e2f34455604b651d1c50f14ad8464cf98feafb4b86f416155980aff9a353a3b6edac944cefa73ebc61b63f5718e0e5

C:\Users\Admin\AppData\Roaming\ujtaddt

MD5 1611ddc5ba7af4c5f4c247c178ccdbb3
SHA1 4be33b42d1def3b0fc027b72efe233b6e05007e5
SHA256 c40a4e9ac9b6cefbfdabd59a314fae01b7fcd0b91e0a7cd8b02afd105a234eb0
SHA512 6d1319e6f8db72bc50e8b77ac470ac1b42e2f34455604b651d1c50f14ad8464cf98feafb4b86f416155980aff9a353a3b6edac944cefa73ebc61b63f5718e0e5

memory/564-2962-0x0000000074590000-0x0000000074D40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7F5F.exe

MD5 4345b942eb187e2b867a6e9524d166e0
SHA1 1814c6a4205852069bbaaf9c8bd2809842d52548
SHA256 0b80d7aea7acb5d4bd7e6dbfabeaf5529faec78ff5b29fc525edc2c8bf7e537c
SHA512 85f5ecafcb711af6ace4ddb11ca3a8e8d2a4799ba07d258bb731d55dc36614139db760aeea6e1f1d3674bb045230ba9d247c13d895a7f3f85ea26967788a87d6

C:\Users\Admin\AppData\Local\Temp\7F5F.exe

MD5 4345b942eb187e2b867a6e9524d166e0
SHA1 1814c6a4205852069bbaaf9c8bd2809842d52548
SHA256 0b80d7aea7acb5d4bd7e6dbfabeaf5529faec78ff5b29fc525edc2c8bf7e537c
SHA512 85f5ecafcb711af6ace4ddb11ca3a8e8d2a4799ba07d258bb731d55dc36614139db760aeea6e1f1d3674bb045230ba9d247c13d895a7f3f85ea26967788a87d6

memory/2508-2979-0x00000000056C0000-0x0000000005752000-memory.dmp

memory/280-2994-0x0000000000DC0000-0x0000000000DD4000-memory.dmp

memory/2508-3018-0x0000000005760000-0x00000000057FC000-memory.dmp

memory/280-3023-0x0000000074590000-0x0000000074D40000-memory.dmp

memory/280-3084-0x0000000005890000-0x00000000058A0000-memory.dmp

memory/2968-3085-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

C:\Users\Admin\AppData\Roaming\ujtaddt

MD5 aca437ce38321d87762a43706066e567
SHA1 080be782eb0fb865b9b5a7ac0bd091b6cdf8546e
SHA256 6531d5b3bd7f0bd452bf29af73a4a9e34fd2feba6a8c3270cb7584e68e47fb24
SHA512 0b7244da4864839eb5409516034cae7141cbbefdb85d7545f9a57378668ffa7fb0cc426daddd301f89ad05bd0d6e88451b4072eaa4a15b5c5a2b8f23bb29afe5