Malware Analysis Report

2024-10-16 05:10

Sample ID 230924-b3qcmsbf2z
Target 86698bf50808fc5b543ff341820526b6660899c156f73829742f198ed7b018ea
SHA256 86698bf50808fc5b543ff341820526b6660899c156f73829742f198ed7b018ea
Tags
amadey ammyyadmin flawedammyy healer phobos redline rhadamanthys smokeloader nanya backdoor bootkit collection dropper evasion infostealer persistence ransomware rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

86698bf50808fc5b543ff341820526b6660899c156f73829742f198ed7b018ea

Threat Level: Known bad

The file 86698bf50808fc5b543ff341820526b6660899c156f73829742f198ed7b018ea was found to be: Known bad.

Malicious Activity Summary

amadey ammyyadmin flawedammyy healer phobos redline rhadamanthys smokeloader nanya backdoor bootkit collection dropper evasion infostealer persistence ransomware rat spyware stealer trojan

Suspicious use of NtCreateUserProcessOtherParentProcess

Detect rhadamanthys stealer shellcode

RedLine payload

Rhadamanthys

AmmyyAdmin payload

Healer

Modifies Windows Defender Real-time Protection settings

FlawedAmmyy RAT

Detects Healer an antivirus disabler dropper

Phobos

Amadey

RedLine

SmokeLoader

Ammyy Admin

Renames multiple (470) files with added filename extension

Modifies boot configuration data using bcdedit

Deletes shadow copies

Deletes backup catalog

Downloads MZ/PE file

Modifies Windows Firewall

Executes dropped EXE

Reads user/profile data of web browsers

Checks computer location settings

Drops startup file

Loads dropped DLL

Writes to the Master Boot Record (MBR)

Drops desktop.ini file(s)

Accesses Microsoft Outlook profiles

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Launches sc.exe

Program crash

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Modifies registry class

Checks processor information in registry

Uses Volume Shadow Copy service COM API

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of UnmapMainImage

outlook_win_path

Interacts with shadow copies

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

outlook_office_path

Creates scheduled task(s)

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-09-24 01:40

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-24 01:40

Reported

2023-09-24 01:43

Platform

win10v2004-20230915-en

Max time kernel

150s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A

FlawedAmmyy RAT

trojan flawedammyy

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Phobos

ransomware phobos

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 316 created 3224 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (470) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6406316.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2495246.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\F1DD.tmp\svchost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7398746.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9112056.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9742916.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4739665.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2318511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4798845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6406316.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2495246.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7929108.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\BQxD9_v%U0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\BQxD9_v%U0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AB3F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ACD6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AB3F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AB3F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AB3F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B757.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F1DD.tmp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ACD6.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SYSTEM32\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\86698bf50808fc5b543ff341820526b6660899c156f73829742f198ed7b018ea.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7398746.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9112056.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9742916.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4739665.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\J15$2NjP[X = "C:\\Users\\Admin\\AppData\\Local\\J15$2NjP[X.exe" C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\J15$2NjP[X = "C:\\Users\\Admin\\AppData\\Local\\J15$2NjP[X.exe" C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1926387074-3400613176-3566796709-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\F1DD.tmp\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ADALPREVIOUS.DLL.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-time-l1-1-0.dll.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.ITS C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons.png.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-150.png C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\ColorPalette.png C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\close.svg.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_48.png C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailLargeTile.scale-400.png C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\Microsoft.PowerShell.PackageManagement.resources.dll C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\JUICE___.TTF C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\FaceReco_Illustration_LRG.png C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SendMail.api.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluDCFilesEmpty_180x180.svg C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\remove.png C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU3498.tmp\msedgeupdateres_ta.dll.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files\Java\jre1.8.0_66\lib\ext\jaccess.jar.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Data.Common.dll C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\ado\msador15.dll C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\SmallLogo.png C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\deployJava1.dll C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-80_altform-unplated.png C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\ui-strings.js C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\ui-strings.js.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\SystemX86\msvcp140_1.dll.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\x_2x.png.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\196.png C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-32.png C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.MsiProvider.resources.dll C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_duplicate_plugin.dll C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\selector.js.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files\7-Zip\Lang\sq.txt.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-96.png C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-awt.xml.id[ECCFD133-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\mi.pak.DATA C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\BQxD9_v%U0.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\BQxD9_v%U0.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\BQxD9_v%U0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\BQxD9_v%U0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\BQxD9_v%U0.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\BQxD9_v%U0.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AB3F.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ACD6.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\B757.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\F1DD.tmp\svchost.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4468 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\86698bf50808fc5b543ff341820526b6660899c156f73829742f198ed7b018ea.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7398746.exe
PID 4468 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\86698bf50808fc5b543ff341820526b6660899c156f73829742f198ed7b018ea.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7398746.exe
PID 4468 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\86698bf50808fc5b543ff341820526b6660899c156f73829742f198ed7b018ea.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7398746.exe
PID 4140 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7398746.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9112056.exe
PID 4140 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7398746.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9112056.exe
PID 4140 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7398746.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9112056.exe
PID 3524 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9112056.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9742916.exe
PID 3524 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9112056.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9742916.exe
PID 3524 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9112056.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9742916.exe
PID 1600 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9742916.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4739665.exe
PID 1600 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9742916.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4739665.exe
PID 1600 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9742916.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4739665.exe
PID 4068 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4739665.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2318511.exe
PID 4068 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4739665.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2318511.exe
PID 4068 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4739665.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2318511.exe
PID 3756 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2318511.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3756 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2318511.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3756 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2318511.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3756 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2318511.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3756 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2318511.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3756 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2318511.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3756 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2318511.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3756 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2318511.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4068 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4739665.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe
PID 4068 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4739665.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe
PID 4068 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4739665.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe
PID 4840 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4840 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4840 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4840 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4840 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4840 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4840 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4840 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4840 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4840 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1600 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9742916.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4798845.exe
PID 1600 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9742916.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4798845.exe
PID 1600 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9742916.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4798845.exe
PID 3032 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4798845.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3032 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4798845.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3032 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4798845.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3032 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4798845.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3032 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4798845.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3032 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4798845.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3032 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4798845.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3032 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4798845.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3524 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9112056.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6406316.exe
PID 3524 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9112056.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6406316.exe
PID 3524 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9112056.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6406316.exe
PID 1508 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6406316.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
PID 1508 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6406316.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
PID 1508 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6406316.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
PID 4140 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7398746.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2495246.exe
PID 4140 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7398746.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2495246.exe
PID 4140 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7398746.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2495246.exe
PID 3416 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe C:\Windows\SysWOW64\schtasks.exe
PID 3416 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe C:\Windows\SysWOW64\schtasks.exe
PID 3416 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe C:\Windows\SysWOW64\schtasks.exe
PID 3416 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe C:\Windows\SysWOW64\cmd.exe
PID 3416 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe C:\Windows\SysWOW64\cmd.exe
PID 3416 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 3352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 3352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\86698bf50808fc5b543ff341820526b6660899c156f73829742f198ed7b018ea.exe

"C:\Users\Admin\AppData\Local\Temp\86698bf50808fc5b543ff341820526b6660899c156f73829742f198ed7b018ea.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7398746.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7398746.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9112056.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9112056.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9742916.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9742916.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4739665.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4739665.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2318511.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2318511.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3756 -ip 3756

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 552

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4840 -ip 4840

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4676 -ip 4676

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 540

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4798845.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4798845.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3032 -ip 3032

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 552

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6406316.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6406316.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2495246.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2495246.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explonde.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explonde.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7929108.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7929108.exe

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legota.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legota.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\cb378487cf" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\cb378487cf" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

"C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe"

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe

"C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe"

C:\Users\Admin\AppData\Local\Microsoft\BQxD9_v%U0.exe

"C:\Users\Admin\AppData\Local\Microsoft\BQxD9_v%U0.exe"

C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe

C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe

C:\Users\Admin\AppData\Local\Microsoft\BQxD9_v%U0.exe

C:\Users\Admin\AppData\Local\Microsoft\BQxD9_v%U0.exe

C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe

"C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe"

C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe

C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Users\Admin\AppData\Local\Temp\AB3F.exe

C:\Users\Admin\AppData\Local\Temp\AB3F.exe

C:\Users\Admin\AppData\Local\Temp\ACD6.exe

C:\Users\Admin\AppData\Local\Temp\ACD6.exe

C:\Users\Admin\AppData\Local\Temp\AB3F.exe

C:\Users\Admin\AppData\Local\Temp\AB3F.exe

C:\Users\Admin\AppData\Local\Temp\AB3F.exe

C:\Users\Admin\AppData\Local\Temp\AB3F.exe

C:\Users\Admin\AppData\Local\Temp\AB3F.exe

C:\Users\Admin\AppData\Local\Temp\AB3F.exe

C:\Users\Admin\AppData\Local\Temp\B757.exe

C:\Users\Admin\AppData\Local\Temp\B757.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3520 -ip 3520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1952

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3520 -ip 3520

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1952

C:\Users\Admin\AppData\Local\Temp\ACD6.exe

"C:\Users\Admin\AppData\Local\Temp\ACD6.exe"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\F1DD.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\F1DD.tmp\svchost.exe -debug

C:\Windows\SYSTEM32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\F1DD.tmp\aa_nts.dll",run

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start wuauserv

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 39.142.81.104.in-addr.arpa udp
FI 77.91.124.82:19071 tcp
FI 77.91.68.52:80 77.91.68.52 tcp
FI 77.91.68.78:80 77.91.68.78 tcp
US 8.8.8.8:53 amx385.xyz udp
DE 45.89.127.193:80 amx385.xyz tcp
US 8.8.8.8:53 52.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 78.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 193.127.89.45.in-addr.arpa udp
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 61.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
FI 77.91.124.82:19071 tcp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
FI 77.91.68.52:80 77.91.68.52 tcp
FI 77.91.68.78:80 77.91.68.78 tcp
FI 77.91.124.82:19071 tcp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 120.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 mksad917.xyz udp
DE 193.31.28.70:80 mksad917.xyz tcp
US 8.8.8.8:53 70.28.31.193.in-addr.arpa udp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 qu.ax udp
IL 91.226.72.136:443 qu.ax tcp
US 8.8.8.8:53 136.72.226.91.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
FI 77.91.124.82:19071 tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.242:443 tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 148.129.42.188.in-addr.arpa udp
US 8.8.8.8:53 242.104.243.136.in-addr.arpa udp
US 8.8.8.8:53 www.ammyy.com udp
DE 136.243.18.118:80 www.ammyy.com tcp
DE 136.243.18.118:443 www.ammyy.com tcp
US 8.8.8.8:53 118.18.243.136.in-addr.arpa udp
US 8.8.8.8:53 147.174.42.23.in-addr.arpa udp
US 8.8.8.8:53 176.25.221.88.in-addr.arpa udp
FI 77.91.124.82:19071 tcp
US 8.8.8.8:53 168.117.168.52.in-addr.arpa udp
FI 77.91.124.82:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7398746.exe

MD5 a6fdb245ce54149edacdfdd309ae2d80
SHA1 172d23a0d5615012f04d33e5aaadae759ae4bf96
SHA256 4ca5cc2a2338006f6c91dcaf233487054ec56548acca157a8f28261b818ccba2
SHA512 ae918653007a27e0389b8b57a5c8c69f59d94709194fdf17d80479858b6d0d1f56dd8e008e191f25df8bace01d01e96a6faf20f52e3f81ce39215e7db3020041

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7398746.exe

MD5 a6fdb245ce54149edacdfdd309ae2d80
SHA1 172d23a0d5615012f04d33e5aaadae759ae4bf96
SHA256 4ca5cc2a2338006f6c91dcaf233487054ec56548acca157a8f28261b818ccba2
SHA512 ae918653007a27e0389b8b57a5c8c69f59d94709194fdf17d80479858b6d0d1f56dd8e008e191f25df8bace01d01e96a6faf20f52e3f81ce39215e7db3020041

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9112056.exe

MD5 336b31e1f8e338af8f705f71d86c193d
SHA1 ffe60c301833857dd609a90a7ee08263aee87055
SHA256 9e6a82ed6b6c702b776b5a66fb935706a29b1927f625ed2f144465b34d69bd58
SHA512 d7484275a8f0520dcaf642d7b1270e852e8a8f2a9d0e355ac3ff6c53e539ad037d1586ab24c83346f78856ed4139d192efa95279846af915a7bbc601b94a9b12

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9112056.exe

MD5 336b31e1f8e338af8f705f71d86c193d
SHA1 ffe60c301833857dd609a90a7ee08263aee87055
SHA256 9e6a82ed6b6c702b776b5a66fb935706a29b1927f625ed2f144465b34d69bd58
SHA512 d7484275a8f0520dcaf642d7b1270e852e8a8f2a9d0e355ac3ff6c53e539ad037d1586ab24c83346f78856ed4139d192efa95279846af915a7bbc601b94a9b12

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9742916.exe

MD5 48dd7831a477798e09521d6d0e91a1f0
SHA1 15b2797097df029ce0834c32556d74eeb4fa3d2e
SHA256 bfcf787efc0341753f20fe4aa0d565d353d5083a593a8c0caf494418ee3299ba
SHA512 985b3254e766be54e6a8ee769cde95ca468724709e89720726c1072b2d0d49078ca4fc07414e7e85624b91532e3e89b77e4d64c44136c3b4b08dce85c4dec261

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9742916.exe

MD5 48dd7831a477798e09521d6d0e91a1f0
SHA1 15b2797097df029ce0834c32556d74eeb4fa3d2e
SHA256 bfcf787efc0341753f20fe4aa0d565d353d5083a593a8c0caf494418ee3299ba
SHA512 985b3254e766be54e6a8ee769cde95ca468724709e89720726c1072b2d0d49078ca4fc07414e7e85624b91532e3e89b77e4d64c44136c3b4b08dce85c4dec261

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4739665.exe

MD5 c59e7879c006a2f6b49a8533a8f27f52
SHA1 1a3e1eeeb8840e83194fde6da10e021da5d3a773
SHA256 e35d402d511f74d7aef6f976f1377f55a8613f7a8db92437c59d6d8789a4598d
SHA512 cd7f14c7b16b7738cdc533d177c956cf9908d73a5d1e548d195799bbc7ef6aee709ca9dc03215c4f32602a21810d15ef08b77c7fc506f2a58d55a9fed464892b

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4739665.exe

MD5 c59e7879c006a2f6b49a8533a8f27f52
SHA1 1a3e1eeeb8840e83194fde6da10e021da5d3a773
SHA256 e35d402d511f74d7aef6f976f1377f55a8613f7a8db92437c59d6d8789a4598d
SHA512 cd7f14c7b16b7738cdc533d177c956cf9908d73a5d1e548d195799bbc7ef6aee709ca9dc03215c4f32602a21810d15ef08b77c7fc506f2a58d55a9fed464892b

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2318511.exe

MD5 77d810700ca22b14baeff270dd9f9ad2
SHA1 a4a8279c52929096157863569f29a83c8b973be0
SHA256 4cf9e115c6fff2c05c245ee87a93ade7ceec46c11d28b6a75374d57151258a03
SHA512 f8bb97b00ffbdf88e82e857476672d4bb8ec95992d2cd1a2e85fff2ee80e162242a65fe1c3b67dafb495eeb8dae3a5e10bbb18975dce1b9facc8444ed60680a1

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2318511.exe

MD5 77d810700ca22b14baeff270dd9f9ad2
SHA1 a4a8279c52929096157863569f29a83c8b973be0
SHA256 4cf9e115c6fff2c05c245ee87a93ade7ceec46c11d28b6a75374d57151258a03
SHA512 f8bb97b00ffbdf88e82e857476672d4bb8ec95992d2cd1a2e85fff2ee80e162242a65fe1c3b67dafb495eeb8dae3a5e10bbb18975dce1b9facc8444ed60680a1

memory/732-35-0x0000000000400000-0x000000000040A000-memory.dmp

memory/732-36-0x00000000749E0000-0x0000000075190000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe

MD5 74c2416eb3d1a7996d196651118effbc
SHA1 f819eaf97879d598c9c8c41a187ab941662cdb28
SHA256 3513b93a078efec391f1a3bec8ada0bd8a9f3523a6c6dbc7493ccb6dad62ac12
SHA512 782eac42431f2e32de0c475eab1f787ca66fe183260e989420c26eb483000b7cc1a06abe4db3971dde018d21386426ce24ac880edc2bf1eda465af3c879d0734

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8225120.exe

MD5 74c2416eb3d1a7996d196651118effbc
SHA1 f819eaf97879d598c9c8c41a187ab941662cdb28
SHA256 3513b93a078efec391f1a3bec8ada0bd8a9f3523a6c6dbc7493ccb6dad62ac12
SHA512 782eac42431f2e32de0c475eab1f787ca66fe183260e989420c26eb483000b7cc1a06abe4db3971dde018d21386426ce24ac880edc2bf1eda465af3c879d0734

memory/4676-40-0x0000000000400000-0x000000000042C000-memory.dmp

memory/4676-41-0x0000000000400000-0x000000000042C000-memory.dmp

memory/4676-42-0x0000000000400000-0x000000000042C000-memory.dmp

memory/4676-44-0x0000000000400000-0x000000000042C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4798845.exe

MD5 4faf1251e4c29df8ba8e6a83dc671af6
SHA1 b1dd967703a6f2632334fbbbcdc2e7c62c812134
SHA256 5f89fcc7c00dfb580922a24bf3d341dd076a4bb7eb46f8eca6735ab6bf0743e8
SHA512 6e60fe4ac906fb1c084f40e587c0773fde09bdaaa993ecdf0b51afcf59dbe310d877addb6ff6f673fa97283a6514264352ec146f325794c19ec5cd3856e89d6c

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4798845.exe

MD5 4faf1251e4c29df8ba8e6a83dc671af6
SHA1 b1dd967703a6f2632334fbbbcdc2e7c62c812134
SHA256 5f89fcc7c00dfb580922a24bf3d341dd076a4bb7eb46f8eca6735ab6bf0743e8
SHA512 6e60fe4ac906fb1c084f40e587c0773fde09bdaaa993ecdf0b51afcf59dbe310d877addb6ff6f673fa97283a6514264352ec146f325794c19ec5cd3856e89d6c

memory/1292-48-0x0000000000400000-0x0000000000430000-memory.dmp

memory/1292-50-0x00000000749E0000-0x0000000075190000-memory.dmp

memory/1292-49-0x0000000003110000-0x0000000003116000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6406316.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6406316.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

memory/1292-54-0x0000000005F10000-0x0000000006528000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

memory/1292-57-0x0000000005A10000-0x0000000005B1A000-memory.dmp

memory/1292-58-0x0000000005950000-0x0000000005962000-memory.dmp

memory/732-59-0x00000000749E0000-0x0000000075190000-memory.dmp

memory/1292-60-0x00000000059B0000-0x00000000059EC000-memory.dmp

memory/1292-61-0x00000000057A0000-0x00000000057B0000-memory.dmp

memory/1292-62-0x0000000005B20000-0x0000000005B6C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

memory/732-69-0x00000000749E0000-0x0000000075190000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2495246.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2495246.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7929108.exe

MD5 89347300b0703c788c02a2633f510abc
SHA1 6cfa75695d42b40e48a68afebce7cd915dd734bd
SHA256 baabad7d572de149749729a3394990c45d1c3fd2f69868714b9246767812502f
SHA512 27614fd85bd0ef5a665551aafe83aaff97280486fa6bc71f34f380ff4a5b185881f320ba6801a82742ee3e2752fbab7e72633d2b0a48830c4b21a25f56d3c0d3

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7929108.exe

MD5 89347300b0703c788c02a2633f510abc
SHA1 6cfa75695d42b40e48a68afebce7cd915dd734bd
SHA256 baabad7d572de149749729a3394990c45d1c3fd2f69868714b9246767812502f
SHA512 27614fd85bd0ef5a665551aafe83aaff97280486fa6bc71f34f380ff4a5b185881f320ba6801a82742ee3e2752fbab7e72633d2b0a48830c4b21a25f56d3c0d3

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

memory/1116-103-0x0000000000F40000-0x0000000001126000-memory.dmp

memory/1116-104-0x00000000749E0000-0x0000000075190000-memory.dmp

memory/1116-105-0x0000000005AC0000-0x0000000005B38000-memory.dmp

memory/1116-106-0x0000000005C00000-0x0000000005C10000-memory.dmp

memory/1116-107-0x0000000005B40000-0x0000000005BA8000-memory.dmp

memory/1116-108-0x0000000005BB0000-0x0000000005BFC000-memory.dmp

memory/1116-109-0x0000000006200000-0x00000000067A4000-memory.dmp

memory/316-110-0x0000000000400000-0x0000000000473000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000058001\rh111.exe

MD5 1b87684768db892932be3f0661c54251
SHA1 e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512 0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

memory/1116-114-0x00000000749E0000-0x0000000075190000-memory.dmp

memory/316-115-0x0000000000400000-0x0000000000473000-memory.dmp

memory/316-117-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1292-118-0x00000000749E0000-0x0000000075190000-memory.dmp

memory/316-119-0x0000000002C70000-0x0000000002C77000-memory.dmp

memory/316-120-0x0000000002D10000-0x0000000003110000-memory.dmp

memory/1292-121-0x00000000057A0000-0x00000000057B0000-memory.dmp

memory/316-122-0x0000000002D10000-0x0000000003110000-memory.dmp

memory/316-123-0x0000000002D10000-0x0000000003110000-memory.dmp

memory/316-124-0x0000000002D10000-0x0000000003110000-memory.dmp

memory/4756-125-0x0000020ABDFF0000-0x0000020ABDFF3000-memory.dmp

memory/316-126-0x0000000003BA0000-0x0000000003BD6000-memory.dmp

memory/316-133-0x0000000002D10000-0x0000000003110000-memory.dmp

memory/316-132-0x0000000003BA0000-0x0000000003BD6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

memory/4756-136-0x0000020ABDFF0000-0x0000020ABDFF3000-memory.dmp

memory/4756-137-0x0000020ABE190000-0x0000020ABE197000-memory.dmp

memory/4756-139-0x00007FF4A8FE0000-0x00007FF4A910F000-memory.dmp

memory/4756-138-0x00007FF4A8FE0000-0x00007FF4A910F000-memory.dmp

memory/4756-140-0x00007FF4A8FE0000-0x00007FF4A910F000-memory.dmp

memory/4756-141-0x00007FF4A8FE0000-0x00007FF4A910F000-memory.dmp

memory/4756-145-0x00007FF4A8FE0000-0x00007FF4A910F000-memory.dmp

memory/4756-143-0x00007FF4A8FE0000-0x00007FF4A910F000-memory.dmp

memory/4756-146-0x00007FF4A8FE0000-0x00007FF4A910F000-memory.dmp

memory/4756-147-0x00007FF4A8FE0000-0x00007FF4A910F000-memory.dmp

memory/4756-148-0x00007FFDCC690000-0x00007FFDCC885000-memory.dmp

memory/4756-149-0x00007FF4A8FE0000-0x00007FF4A910F000-memory.dmp

memory/4756-150-0x00007FF4A8FE0000-0x00007FF4A910F000-memory.dmp

memory/4756-151-0x00007FF4A8FE0000-0x00007FF4A910F000-memory.dmp

memory/4756-152-0x00007FF4A8FE0000-0x00007FF4A910F000-memory.dmp

memory/4756-153-0x00007FF4A8FE0000-0x00007FF4A910F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

memory/4756-157-0x00007FFDCC690000-0x00007FFDCC885000-memory.dmp

memory/4808-160-0x00000000749E0000-0x0000000075190000-memory.dmp

memory/4808-158-0x00000000002A0000-0x00000000002E8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\BQxD9_v%U0.exe

MD5 f303bcd11ab0d3f55980064dee528ab5
SHA1 815aaa887d7991ec9dcda8f0e1adea12f76aa789
SHA256 21fb9e94c2c0cd34955a9315539053cf736135254de72bfab497c88d01ee76f0
SHA512 371cc13d036b31ac71cd19c308d4e608e3225380c57de9d8448fb5849ad1c465ea51de1c9bd39d8570a807f5222c2853e5c10a59583ffcc96cffe52765741cf6

memory/4808-164-0x0000000004C50000-0x0000000004C60000-memory.dmp

memory/4808-165-0x00000000025C0000-0x0000000002606000-memory.dmp

memory/3516-166-0x00000000056D0000-0x0000000005714000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\BQxD9_v%U0.exe

MD5 f303bcd11ab0d3f55980064dee528ab5
SHA1 815aaa887d7991ec9dcda8f0e1adea12f76aa789
SHA256 21fb9e94c2c0cd34955a9315539053cf736135254de72bfab497c88d01ee76f0
SHA512 371cc13d036b31ac71cd19c308d4e608e3225380c57de9d8448fb5849ad1c465ea51de1c9bd39d8570a807f5222c2853e5c10a59583ffcc96cffe52765741cf6

memory/3516-168-0x00000000749E0000-0x0000000075190000-memory.dmp

memory/3516-169-0x0000000005730000-0x0000000005762000-memory.dmp

memory/4808-167-0x0000000004B80000-0x0000000004BB4000-memory.dmp

memory/3516-163-0x0000000000E40000-0x0000000000E84000-memory.dmp

memory/5032-170-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

memory/4888-176-0x0000000000400000-0x000000000040B000-memory.dmp

memory/5032-177-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\BQxD9_v%U0.exe

MD5 f303bcd11ab0d3f55980064dee528ab5
SHA1 815aaa887d7991ec9dcda8f0e1adea12f76aa789
SHA256 21fb9e94c2c0cd34955a9315539053cf736135254de72bfab497c88d01ee76f0
SHA512 371cc13d036b31ac71cd19c308d4e608e3225380c57de9d8448fb5849ad1c465ea51de1c9bd39d8570a807f5222c2853e5c10a59583ffcc96cffe52765741cf6

memory/4888-180-0x0000000000400000-0x000000000040B000-memory.dmp

memory/5032-175-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4808-174-0x00000000749E0000-0x0000000075190000-memory.dmp

memory/3516-181-0x00000000749E0000-0x0000000075190000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\J15$2NjP[X.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

memory/2236-184-0x00000000749E0000-0x0000000075190000-memory.dmp

memory/2236-185-0x00000000011D0000-0x00000000011E0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\J15$2NjP[X.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

memory/2236-190-0x00000000749E0000-0x0000000075190000-memory.dmp

memory/3908-191-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4756-192-0x0000020ABE190000-0x0000020ABE195000-memory.dmp

memory/4756-193-0x00007FFDCC690000-0x00007FFDCC885000-memory.dmp

memory/3224-194-0x0000000000940000-0x0000000000956000-memory.dmp

memory/4888-195-0x0000000000400000-0x000000000040B000-memory.dmp

memory/5032-207-0x0000000000400000-0x0000000000413000-memory.dmp

memory/5032-210-0x0000000000400000-0x0000000000413000-memory.dmp

memory/5032-208-0x0000000000400000-0x0000000000413000-memory.dmp

memory/5032-214-0x0000000000400000-0x0000000000413000-memory.dmp

memory/5032-212-0x0000000000400000-0x0000000000413000-memory.dmp

memory/5032-215-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[ECCFD133-3483].[[email protected]].8base

MD5 f5d8e81ea43c26331c945bde7cf6ff1d
SHA1 4b4a00c18a9fb577d14f528aecc7300a12fb4481
SHA256 ec3110ee3dcc55a7dbda9ee9bb80763ef6cfc4bce780b5f2d2f2fac363d2f094
SHA512 bb5c3ec5d19b23094be200380e6c0cb574a4c5389e4698f7ee91718aff6b5b1520c7751cb84a4d17208b2bbb4a48a3cb2f0082488c9b4b02ff85e236f0c7d80a

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 0c459e65bcc6d38574f0c0d63a87088a
SHA1 41e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256 871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512 be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 2ac6d3fcf6913b1a1ac100407e97fccb
SHA1 809f7d4ed348951b79745074487956255d1d0a9a
SHA256 30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA512 79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 2ac6d3fcf6913b1a1ac100407e97fccb
SHA1 809f7d4ed348951b79745074487956255d1d0a9a
SHA256 30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA512 79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 2ac6d3fcf6913b1a1ac100407e97fccb
SHA1 809f7d4ed348951b79745074487956255d1d0a9a
SHA256 30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA512 79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 6d5040418450624fef735b49ec6bffe9
SHA1 5fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256 dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512 bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 ec41f740797d2253dc1902e71941bbdb
SHA1 407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA256 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512 e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 ec41f740797d2253dc1902e71941bbdb
SHA1 407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA256 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512 e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 ec41f740797d2253dc1902e71941bbdb
SHA1 407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA256 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512 e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

memory/3908-1210-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AB3F.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

C:\Users\Admin\AppData\Local\Temp\AB3F.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

C:\Users\Admin\AppData\Local\Temp\AB3F.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

memory/684-3775-0x00000000749E0000-0x0000000075190000-memory.dmp

memory/684-3807-0x0000000005860000-0x0000000005870000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ACD6.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\ACD6.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/3392-3898-0x00000000057A0000-0x0000000005832000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AB3F.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

C:\Users\Admin\AppData\Local\Temp\AB3F.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

memory/3392-3921-0x00000000058E0000-0x000000000597C000-memory.dmp

memory/3536-3927-0x0000000000400000-0x0000000000413000-memory.dmp

memory/684-3930-0x00000000749E0000-0x0000000075190000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AB3F.exe

MD5 5d2b3f808075ab6e605f4242d9c7a398
SHA1 2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b
SHA256 32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964
SHA512 901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

memory/3392-3876-0x0000000000E50000-0x0000000000ECC000-memory.dmp

memory/3392-3956-0x00000000066B0000-0x00000000066C0000-memory.dmp

memory/3392-3875-0x00000000749E0000-0x0000000075190000-memory.dmp

memory/3392-4006-0x00000000066C0000-0x0000000006702000-memory.dmp

memory/3392-4078-0x0000000006A30000-0x0000000006A3A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B757.exe

MD5 400261992d812b24ecd3bfe79700443c
SHA1 f4f0d341cc860f046b2713939c70da32944f7eda
SHA256 222a5af34881bb68ffc370491a0f8d67b550cd368c49927715946365bbe8038f
SHA512 ed25f5d636658f629625614a95d4bc7a999b10cb2689c38159afa5ff24afd5136119500d00ebe83d880702f9b8e560fb570d92199f56e865eccca9695b8582f9

C:\Users\Admin\AppData\Local\Temp\B757.exe

MD5 400261992d812b24ecd3bfe79700443c
SHA1 f4f0d341cc860f046b2713939c70da32944f7eda
SHA256 222a5af34881bb68ffc370491a0f8d67b550cd368c49927715946365bbe8038f
SHA512 ed25f5d636658f629625614a95d4bc7a999b10cb2689c38159afa5ff24afd5136119500d00ebe83d880702f9b8e560fb570d92199f56e865eccca9695b8582f9

memory/3520-4093-0x0000000000400000-0x000000000057A000-memory.dmp

memory/3520-4117-0x00000000749E0000-0x0000000075190000-memory.dmp

memory/3520-4208-0x0000000004F00000-0x0000000004F10000-memory.dmp

memory/3520-4151-0x00000000027B0000-0x00000000027B8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k16kyoly.default-release\cookies.sqlite.id[ECCFD133-3483].[[email protected]].8base

MD5 e7c31ccdb6aa8e89c11edf91ffa8e0da
SHA1 bd2e5675c075eb50f0aa025dda29b2a3d800027d
SHA256 80d7fb8a2da0531e24843ed5f8db6227c5a0c347f412de2a3b3e79ab0e73b286
SHA512 fef6a38987add2cca2f51da407a886bbf44b1c90f5fd44a77bd5779ef131080b6e60a4f5ae1a6f416a163bc984484b8ce29dcf56aa9be8087e0dd0ec9e312098

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

MD5 a427281ec99595c2a977a70e0009a30c
SHA1 c937c5d14127921f068a081bb3e8f450c9966852
SHA256 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA512 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

MD5 c256a814d3f9d02d73029580dfe882b3
SHA1 e11e9ea937183139753f3b0d5e71c8301d000896
SHA256 53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA512 1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

C:\Users\Admin\AppData\Local\Temp\F1DD.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\F1DD.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\F1DD.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\F1DD.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\F1DD.tmp\aa_nts.msg

MD5 3f05819f995b4dafa1b5d55ce8d1f411
SHA1 404449b79a16bfc4f64f2fd55cd73d5d27a85d71
SHA256 7e0bf0cbd06a087500a9c3b50254df3a8a2c2980921ab6a62ab1121941c80fc0
SHA512 34abb7df8b3a68e1649ff0d2762576a4d4e65da548e74b1aa65c2b82c1b89f90d053ecddac67c614ca6084dc5b2cb552949250fb70f49b536f1bcb0057717026

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BQxD9_v%U0.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rh111.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AB3F.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000027.db.id[ECCFD133-3483].[[email protected]].8base

MD5 5aff98bc4de4de9844e0eec56ccfc80a
SHA1 3f29266231b2f5e137b1720ee3d072510d7077e1
SHA256 e3dd83a73c9d0c8215c04dc63ea397fc007080a903a4a063547526405724d276
SHA512 7f04eec645e70f0c0a8f24bad72e996ece8330445fd226cbad8b3cd31f187bf6943f1ddb06ad31c9e3ce47dabb2cf8af569b40aa12023fd31425dc269df7b143

C:\info.hta

MD5 fcd56d79650e966cf400a3e64ad0c116
SHA1 bb6e65d1a7a90357d6fec39660f56c7e058e3680
SHA256 3d14b6150d26e75e1171362afc70095639c4c65d50f5654afa49549bfe467aad
SHA512 da57f207fa77cd4b4caa4153670004efec8eb8f8bb58ee4278754ce2e969e0100f6975e0a161785cbccd6547fff2e0a5538924632001668e4751222e57413a57

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db

MD5 ae6fbded57f9f7d048b95468ddee47ca
SHA1 c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA256 d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
SHA512 f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3