Malware Analysis Report

2024-10-16 05:11

Sample ID 230925-b2l9lace87
Target 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
Tags
ammyyadmin flawedammyy phobos rhadamanthys bootkit collection evasion persistence ransomware rat spyware stealer trojan smokeloader backdoor
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636

Threat Level: Known bad

The file 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636 was found to be: Known bad.

Malicious Activity Summary

ammyyadmin flawedammyy phobos rhadamanthys bootkit collection evasion persistence ransomware rat spyware stealer trojan smokeloader backdoor

Ammyy Admin

AmmyyAdmin payload

Phobos

Suspicious use of NtCreateUserProcessOtherParentProcess

Detect rhadamanthys stealer shellcode

SmokeLoader

Rhadamanthys

FlawedAmmyy RAT

Modifies boot configuration data using bcdedit

Renames multiple (315) files with added filename extension

Deletes shadow copies

Renames multiple (465) files with added filename extension

Downloads MZ/PE file

Deletes backup catalog

Modifies Windows Firewall

Blocklisted process makes network request

Executes dropped EXE

Checks computer location settings

Reads user/profile data of web browsers

Deletes itself

Loads dropped DLL

Drops startup file

Drops desktop.ini file(s)

Writes to the Master Boot Record (MBR)

Accesses Microsoft Outlook profiles

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Suspicious use of SendNotifyMessage

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Modifies registry class

outlook_office_path

Interacts with shadow copies

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_win_path

Checks processor information in registry

Checks SCSI registry key(s)

Uses Task Scheduler COM API

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-09-25 01:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-25 01:38

Reported

2023-09-25 01:43

Platform

win7-20230831-en

Max time kernel

300s

Max time network

298s

Command Line

C:\Windows\Explorer.EXE

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

FlawedAmmyy RAT

trojan flawedammyy

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2020 created 1224 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (315) files with added filename extension

ransomware

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\AAB1.tmp\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\certreq.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\[`XcL9Bj6 = "C:\\Users\\Admin\\AppData\\Local\\[`XcL9Bj6.exe" C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows\CurrentVersion\Run\[`XcL9Bj6 = "C:\\Users\\Admin\\AppData\\Local\\[`XcL9Bj6.exe" C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\57C2.exe'\"" C:\Users\Admin\AppData\Local\Temp\57C2.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2180306848-1874213455-4093218721-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RVP21N5Z\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SXS5LU8S\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-2180306848-1874213455-4093218721-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ABCBOVYV\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U138LU7C\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\LIV4UTQ0\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\AAB1.tmp\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageSmall.jpg.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\CAPSULES.ELM C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200183.WMF.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0215086.WMF C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABEL.XML C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_COL.HXC C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.policy.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Uzhgorod C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Windows Mail\fr-FR\msoeres.dll.mui C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HM00116_.WMF C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0158477.WMF C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14755_.GIF C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ClassicPhotoAlbum.potx C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePageSlice.gif C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files\Mozilla Firefox\dependentlibs.list.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0234376.WMF.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EntityPickerIntl.dll C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\alertIcon.png C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\flyout.css C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00221_.WMF.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10254_.GIF C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Sts.css C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Luxembourg C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)redStateIcon.png C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR12F.GIF C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\OUTLFLTR.DLL.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\library.js C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\MST.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libtwolame_plugin.dll C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\PROFILE.INF C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\PABR.SAM.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libts_plugin.dll.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02356_.WMF C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SHOW_01.MID.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0222019.WMF.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT_COL.HXC.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR31F.GIF C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePage.html C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287645.JPG C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0284916.JPG.id[E90ACFBF-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryNewsletter.dotx C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\service.js C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Roaming\crvjart N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Roaming\crvjart N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Roaming\crvjart N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\499E.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\57C2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\crvjart N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2624 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
PID 2624 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
PID 2624 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
PID 2624 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
PID 2624 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
PID 2624 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
PID 2624 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
PID 2624 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
PID 2624 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
PID 2020 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Windows\system32\certreq.exe
PID 2020 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Windows\system32\certreq.exe
PID 2020 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Windows\system32\certreq.exe
PID 2020 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Windows\system32\certreq.exe
PID 2020 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Windows\system32\certreq.exe
PID 2020 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Windows\system32\certreq.exe
PID 2384 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 2384 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 2384 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 2384 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 2384 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 2384 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 2384 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 2384 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 2384 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 2384 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 2384 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 2384 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 2384 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 2384 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 2384 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 2612 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe
PID 2612 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe
PID 2612 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe
PID 2612 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe
PID 2612 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe
PID 2612 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe
PID 2612 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe
PID 480 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 480 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 480 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 480 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 480 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 480 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 480 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 480 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 480 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 480 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 480 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe
PID 2632 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Windows\system32\cmd.exe
PID 2632 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Windows\system32\cmd.exe
PID 2632 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Windows\system32\cmd.exe
PID 2632 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Windows\system32\cmd.exe
PID 2632 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Windows\system32\cmd.exe
PID 2632 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Windows\system32\cmd.exe
PID 2632 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Windows\system32\cmd.exe
PID 2632 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe C:\Windows\system32\cmd.exe
PID 1648 wrote to memory of 1792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1648 wrote to memory of 1792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1648 wrote to memory of 1792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3008 wrote to memory of 2300 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3008 wrote to memory of 2300 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3008 wrote to memory of 2300 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1648 wrote to memory of 2304 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1648 wrote to memory of 2304 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

"C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe"

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe

"C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe"

C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe

"C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe"

C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe

C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe

C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe

C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe

C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe

"C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe"

C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe

C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe

C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe

C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Users\Admin\AppData\Local\Temp\499E.exe

C:\Users\Admin\AppData\Local\Temp\499E.exe

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Users\Admin\AppData\Local\Temp\499E.exe

C:\Users\Admin\AppData\Local\Temp\499E.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Users\Admin\AppData\Local\Temp\57C2.exe

C:\Users\Admin\AppData\Local\Temp\57C2.exe

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\system32\taskeng.exe

taskeng.exe {CA53307A-DD05-45B0-B7ED-0DA3F177B5E6} S-1-5-21-2180306848-1874213455-4093218721-1000:XEBBURHY\Admin:Interactive:[1]

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Users\Admin\AppData\Roaming\crvjart

C:\Users\Admin\AppData\Roaming\crvjart

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\AAB1.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\AAB1.tmp\svchost.exe -debug

C:\Windows\SysWOW64\ctfmon.exe

ctfmon.exe

C:\Users\Admin\AppData\Roaming\crvjart

C:\Users\Admin\AppData\Roaming\crvjart

C:\Users\Admin\AppData\Roaming\crvjart

C:\Users\Admin\AppData\Roaming\crvjart

C:\Users\Admin\AppData\Local\Temp\57C2.exe

"C:\Users\Admin\AppData\Local\Temp\57C2.exe"

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\AAB1.tmp\aa_nts.dll",run

C:\Users\Admin\AppData\Local\Temp\57C2.exe

"C:\Users\Admin\AppData\Local\Temp\57C2.exe"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 sentrex219.xyz udp
DE 193.31.28.70:80 sentrex219.xyz tcp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 apps.identrust.com udp
US 2.18.121.141:80 apps.identrust.com tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.242:443 tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 www.ammyy.com udp
DE 136.243.18.118:80 www.ammyy.com tcp
DE 136.243.18.118:443 www.ammyy.com tcp
DE 85.10.193.215:80 tcp
US 8.8.8.8:53 mxstat215dm.xyz udp
DE 45.131.66.83:4044 mxstat215dm.xyz tcp

Files

memory/2624-0-0x0000000000DD0000-0x0000000000FB6000-memory.dmp

memory/2624-1-0x0000000074370000-0x0000000074A5E000-memory.dmp

memory/2624-2-0x0000000000AE0000-0x0000000000B58000-memory.dmp

memory/2624-3-0x0000000000B90000-0x0000000000BD0000-memory.dmp

memory/2624-4-0x0000000000D00000-0x0000000000D68000-memory.dmp

memory/2624-5-0x0000000000330000-0x000000000037C000-memory.dmp

memory/2020-6-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2020-8-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2020-10-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2020-11-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2020-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2020-14-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2624-16-0x0000000074370000-0x0000000074A5E000-memory.dmp

memory/2020-17-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2020-18-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2020-19-0x0000000000220000-0x0000000000227000-memory.dmp

memory/2020-20-0x0000000002560000-0x0000000002960000-memory.dmp

memory/2020-21-0x0000000002560000-0x0000000002960000-memory.dmp

memory/2020-22-0x0000000002560000-0x0000000002960000-memory.dmp

memory/2020-23-0x0000000002560000-0x0000000002960000-memory.dmp

memory/2916-24-0x00000000000E0000-0x00000000000E3000-memory.dmp

memory/2916-25-0x00000000000E0000-0x00000000000E3000-memory.dmp

memory/2020-26-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2020-27-0x00000000003C0000-0x00000000003F6000-memory.dmp

memory/2020-33-0x00000000003C0000-0x00000000003F6000-memory.dmp

memory/2020-34-0x0000000002560000-0x0000000002960000-memory.dmp

memory/2020-35-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2020-36-0x0000000002560000-0x0000000002960000-memory.dmp

memory/2916-38-0x00000000001A0000-0x00000000001A7000-memory.dmp

memory/2916-39-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2916-40-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2916-41-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2916-42-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2916-43-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2916-45-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2916-47-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2916-48-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2916-49-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2916-50-0x0000000077170000-0x0000000077319000-memory.dmp

memory/2916-51-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2916-52-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2916-53-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2916-54-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2916-55-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2916-56-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2916-57-0x0000000077170000-0x0000000077319000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

memory/2384-61-0x0000000001120000-0x0000000001170000-memory.dmp

memory/2384-63-0x0000000000390000-0x00000000003D4000-memory.dmp

memory/2384-62-0x00000000741F0000-0x00000000748DE000-memory.dmp

memory/2384-65-0x0000000001010000-0x0000000001050000-memory.dmp

memory/2384-66-0x00000000004E0000-0x0000000000526000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe

MD5 bd1d8db35bac4d386cde9b8da78eb134
SHA1 9a5826db62ab4f64e60a3a953d1f459c8c292373
SHA256 1f84f2b0a0cb1d58761c95b9fca7cff7676bb5c3715e83f59f9aee6dfb4c6431
SHA512 61412c4e6b318f1c37b2c297741437ab4de45b7eabb30754a9bce74d7bca90d0da181d2b9893382450c9b9e951b400b6fde4196f42be6a59b78eebe0e50e3f4c

memory/2612-69-0x0000000000ED0000-0x0000000000F1C000-memory.dmp

memory/2612-70-0x00000000741F0000-0x00000000748DE000-memory.dmp

memory/2612-71-0x0000000000320000-0x0000000000362000-memory.dmp

memory/2612-74-0x0000000000440000-0x0000000000484000-memory.dmp

memory/2384-73-0x0000000000570000-0x00000000005A4000-memory.dmp

memory/2612-72-0x0000000000610000-0x0000000000650000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe

MD5 bd1d8db35bac4d386cde9b8da78eb134
SHA1 9a5826db62ab4f64e60a3a953d1f459c8c292373
SHA256 1f84f2b0a0cb1d58761c95b9fca7cff7676bb5c3715e83f59f9aee6dfb4c6431
SHA512 61412c4e6b318f1c37b2c297741437ab4de45b7eabb30754a9bce74d7bca90d0da181d2b9893382450c9b9e951b400b6fde4196f42be6a59b78eebe0e50e3f4c

memory/2612-75-0x0000000000520000-0x0000000000552000-memory.dmp

memory/2632-88-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2632-86-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2632-84-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

memory/2632-90-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

memory/2384-94-0x00000000741F0000-0x00000000748DE000-memory.dmp

memory/2288-96-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2632-97-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2288-98-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2632-99-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2288-101-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\2_UX.exe

MD5 bd1d8db35bac4d386cde9b8da78eb134
SHA1 9a5826db62ab4f64e60a3a953d1f459c8c292373
SHA256 1f84f2b0a0cb1d58761c95b9fca7cff7676bb5c3715e83f59f9aee6dfb4c6431
SHA512 61412c4e6b318f1c37b2c297741437ab4de45b7eabb30754a9bce74d7bca90d0da181d2b9893382450c9b9e951b400b6fde4196f42be6a59b78eebe0e50e3f4c

memory/2288-104-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2612-103-0x00000000741F0000-0x00000000748DE000-memory.dmp

memory/2288-95-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2632-82-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2632-80-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2632-78-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

memory/2632-76-0x0000000000400000-0x0000000000413000-memory.dmp

memory/480-106-0x00000000741F0000-0x00000000748DE000-memory.dmp

memory/480-107-0x0000000000210000-0x0000000000256000-memory.dmp

memory/480-108-0x0000000001060000-0x00000000010A0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\[`XcL9Bj6.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

memory/480-119-0x00000000741F0000-0x00000000748DE000-memory.dmp

memory/1556-122-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2916-123-0x00000000001A0000-0x00000000001A2000-memory.dmp

memory/2916-124-0x0000000077170000-0x0000000077319000-memory.dmp

memory/2288-126-0x0000000000400000-0x000000000040B000-memory.dmp

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[E90ACFBF-3483].[[email protected]].8base

MD5 d883f65f6a3167c5c3aa69945659079f
SHA1 bf4928dc150dc404b65adc312eda9b73235be58f
SHA256 a0c1bcfac11ea6b3ad10b178a5e410e2079d6af572a6753be5b1c56dfd761ea6
SHA512 e1ed86984161733dffae590b9c1d7ececfe95352d79d5b6c77418b821104b103afd21a561014eac84bc0fd5c2076e30ad75bf53f51361dd84c40844637bc17c8

C:\Users\Admin\AppData\Local\Temp\499E.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

C:\Users\Admin\AppData\Local\Temp\499E.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

memory/2804-2054-0x0000000000AF0000-0x0000000000B40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\499E.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

memory/2804-2060-0x0000000073B00000-0x00000000741EE000-memory.dmp

memory/2804-2061-0x0000000004730000-0x0000000004770000-memory.dmp

memory/2804-2062-0x00000000004F0000-0x0000000000536000-memory.dmp

\Users\Admin\AppData\Local\Temp\499E.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

C:\Users\Admin\AppData\Local\Temp\499E.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

memory/2804-2232-0x0000000073B00000-0x00000000741EE000-memory.dmp

memory/2444-2233-0x0000000000401000-0x000000000040A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\57C2.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/1972-2303-0x0000000000120000-0x000000000019C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\57C2.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/1972-2304-0x00000000741F0000-0x00000000748DE000-memory.dmp

memory/1972-2649-0x0000000005050000-0x0000000005090000-memory.dmp

memory/1972-2743-0x0000000000520000-0x0000000000562000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab6839.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\Tar6BA6.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6ec560f3521dd84a80c4b4f55191de8b
SHA1 a723146d3788d7b3b4bffe26036269098311053e
SHA256 26e89bc6cecc9c9fd25bb0592cc0c69ac79e8d447b8ab399fc55a1c0dead25cb
SHA512 1b71cdda28c97d484e6a14f6d108c261721884a0a5cadcd417a643035f8ddb83af92ddeb4c0e398fef387468f9ce1e6223dc1264f3b4143a2ba569d4e9cd83e5

memory/568-3128-0x00000000001B0000-0x0000000000225000-memory.dmp

memory/568-3145-0x00000000000F0000-0x000000000015B000-memory.dmp

memory/2608-3235-0x0000000000070000-0x0000000000077000-memory.dmp

memory/568-3233-0x00000000000F0000-0x000000000015B000-memory.dmp

memory/2608-3236-0x0000000000060000-0x000000000006C000-memory.dmp

memory/1972-3237-0x00000000741F0000-0x00000000748DE000-memory.dmp

memory/956-3254-0x0000000000090000-0x0000000000094000-memory.dmp

memory/956-3257-0x0000000000080000-0x0000000000089000-memory.dmp

memory/832-3319-0x00000000000D0000-0x00000000000DA000-memory.dmp

memory/832-3327-0x0000000000080000-0x000000000008B000-memory.dmp

C:\Users\Admin\AppData\Roaming\crvjart

MD5 bd1d8db35bac4d386cde9b8da78eb134
SHA1 9a5826db62ab4f64e60a3a953d1f459c8c292373
SHA256 1f84f2b0a0cb1d58761c95b9fca7cff7676bb5c3715e83f59f9aee6dfb4c6431
SHA512 61412c4e6b318f1c37b2c297741437ab4de45b7eabb30754a9bce74d7bca90d0da181d2b9893382450c9b9e951b400b6fde4196f42be6a59b78eebe0e50e3f4c

C:\Users\Admin\AppData\Roaming\crvjart

MD5 bd1d8db35bac4d386cde9b8da78eb134
SHA1 9a5826db62ab4f64e60a3a953d1f459c8c292373
SHA256 1f84f2b0a0cb1d58761c95b9fca7cff7676bb5c3715e83f59f9aee6dfb4c6431
SHA512 61412c4e6b318f1c37b2c297741437ab4de45b7eabb30754a9bce74d7bca90d0da181d2b9893382450c9b9e951b400b6fde4196f42be6a59b78eebe0e50e3f4c

\Users\Admin\AppData\Local\Temp\AAB1.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\AAB1.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

\Users\Admin\AppData\Local\Temp\AAB1.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\AAB1.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\AAB1.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Roaming\crvjart

MD5 bd1d8db35bac4d386cde9b8da78eb134
SHA1 9a5826db62ab4f64e60a3a953d1f459c8c292373
SHA256 1f84f2b0a0cb1d58761c95b9fca7cff7676bb5c3715e83f59f9aee6dfb4c6431
SHA512 61412c4e6b318f1c37b2c297741437ab4de45b7eabb30754a9bce74d7bca90d0da181d2b9893382450c9b9e951b400b6fde4196f42be6a59b78eebe0e50e3f4c

C:\Users\Admin\AppData\Roaming\crvjart

MD5 bd1d8db35bac4d386cde9b8da78eb134
SHA1 9a5826db62ab4f64e60a3a953d1f459c8c292373
SHA256 1f84f2b0a0cb1d58761c95b9fca7cff7676bb5c3715e83f59f9aee6dfb4c6431
SHA512 61412c4e6b318f1c37b2c297741437ab4de45b7eabb30754a9bce74d7bca90d0da181d2b9893382450c9b9e951b400b6fde4196f42be6a59b78eebe0e50e3f4c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 61404346f99c13a3f3e69e60d1b317d3
SHA1 a2fb953de7064e3722b93378f45713555fec99c8
SHA256 d85a9ae8bc5c3ce6162a3c6e4af5bb388069385f1fa34963e03c18e563b74379
SHA512 9784d848bd2d5edef31521d32751aa7625e0ce145d9306b534f5829e314115218e7713dc29b989afdfc61d09a3046a4848401282fdf16d7fc66908d24fa8ec24

\Users\Admin\AppData\Local\Temp\57C2.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\AAB1.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

\Users\Admin\AppData\Local\Temp\AAB1.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

\Users\Admin\AppData\Local\Temp\AAB1.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

\Users\Admin\AppData\Local\Temp\AAB1.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

\Users\Admin\AppData\Local\Temp\AAB1.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\AAB1.tmp\aa_nts.msg

MD5 3f05819f995b4dafa1b5d55ce8d1f411
SHA1 404449b79a16bfc4f64f2fd55cd73d5d27a85d71
SHA256 7e0bf0cbd06a087500a9c3b50254df3a8a2c2980921ab6a62ab1121941c80fc0
SHA512 34abb7df8b3a68e1649ff0d2762576a4d4e65da548e74b1aa65c2b82c1b89f90d053ecddac67c614ca6084dc5b2cb552949250fb70f49b536f1bcb0057717026

C:\Users\Admin\AppData\Local\Temp\57C2.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

\Users\Admin\AppData\Local\Temp\57C2.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\AAB1.tmp\aa_nts.log

MD5 4ebeca833ae4512bb10623fb69643d7b
SHA1 81fab3ddd629524ea5009afdacb8a070b2f667b0
SHA256 00b54911858c472f588a14179e8cf226974266a4acc124a8489b3d03248bc260
SHA512 7ba8252dc6367816c0f9deb1a6a5d0f8ad034c8988612ae2bce0ff4d27cb8f906f37655fbbd15110e38d9b04c853232b68da64c8f92a9ef67badce8d8527a186

C:\Users\Admin\AppData\Local\Temp\AAB1.tmp\settings3.bin

MD5 aa331ca161809a6d7c83dc356191627e
SHA1 cfa3698dfa60c3f1b59d779636bd42a4806535f8
SHA256 0868877b1629301962bc159b90c3c407121d82618d7868cc1f537c769e55b09f
SHA512 c55810c4416755db43db752b223a90852f88c049c6b6cce7ac92694e18e77ee6e0830a4d02ab399bc72d2ab5c99e59352fa6cbc54ad89b3d0fe27dc58522ea08

C:\Users\Admin\AppData\Local\Temp\AAB1.tmp\hr3

MD5 182fb48735f6e02e5bf6818f2b357d82
SHA1 ae6f68c6d6123e8932d82d48916ee158c3706e47
SHA256 5a08e454d68bdad7b4a10fb34782b0b68b0de65cb730da9ff65e8b93ce140669
SHA512 3c8e8dc26f1deb7dec731632fe8bf695f928b8a1aab32e666f6ab947cc665feaf93984c7ea0d7693af611b5a676a2e53c0323e335bfb2558bd1dea952624545f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5037AC1E573F140500110A0B67548B5E

MD5 46a782c12df5d5972de40d2a2c2f7ff2
SHA1 10482e81ae65bb3fb01c44de2adc9f62abe1806c
SHA256 5598c2dca19b171a3c5aec92c333edd35deab0d31fffb3e029bbec5d89562a81
SHA512 8252ef63339546a8404a7de1be39c6e4ed03d6eb2e92ab45f748b30019eb23b366cbae4461a90205a612ae7b0d1c2cdb65bae82d171c71f2abde1196ada96b0a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

MD5 60fe01df86be2e5331b0cdbe86165686
SHA1 2a79f9713c3f192862ff80508062e64e8e0b29bd
SHA256 c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8
SHA512 ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

MD5 d4ae187b4574036c2d76b6df8a8c1a30
SHA1 b06f409fa14bab33cbaf4a37811b8740b624d9e5
SHA256 a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7
SHA512 1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5037AC1E573F140500110A0B67548B5E

MD5 29d73f29c2080b9b525cf6ea65b13f4d
SHA1 5efa8cbf71ec9f26cfdc82237110e82f0f4b5a9c
SHA256 7858eac2302f1693f6ca7f22b4319df0087b613b2bd8273d1a8cf4fb40d1cf8f
SHA512 a129087a28886f475723c966aa59e76bfa3f19c427f498d59a239e9d520a6685b112fa5444ec5d77c8485303045bd52ce77cb9934ac5f90295492c6077d40a4a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

MD5 653c757f3c0ad55f7e05dac1bb5006a5
SHA1 70d527e5559b391c1c13c2c4976b29d1cd0be43e
SHA256 af6ba363203b395bb6a1fc734b67bb4bcb10331ce907ed6ac3c6fb2ba9c025b9
SHA512 560f3a5ea1c75eb811860a09e43a56536426d253b6af8a52a0c4406beb867049a2b0e6ef132486e224197f970e1f9d817c9e484673bd69e803ea9502a0be59a6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6697fa1c98b9da69b515845781fb033b
SHA1 d1da7fc685e0b02310f812fa284db4f364ca730a
SHA256 fb0a625a03b43caf4033835ae414c2ee7f3ec005c6d139cb0a6ec3ab6fc85fae
SHA512 b8567130e8ca1f2ace81c62e457f0c35b81130add1eee883afbfbf806d8312793652640f996d47508c38ca968367a01601128acebb89b2455af667a6fedff924

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

MD5 ba5d38fa277b7f12eb1e79b801f2bd9a
SHA1 a6015ba900224380a37fbdd017a6a530833e4c39
SHA256 5a51c6ad2be29526bca1efe98c7d36241682430b4e2b75b58158660499badaba
SHA512 77ad5bdd38f15dee3fa66957aedf74c153b530e89baed3137c9421872ae58006bafc898d435be65de905e70d45f07d20c796db7789dfc3d5915f6f72727d92c4

C:\Users\Admin\AppData\Roaming\ahwgtga

MD5 92c68bc8bfbc17a6520aa8c2691ec6dc
SHA1 3df42416b2ce6f4dc44ca6d36149defc9471ad8b
SHA256 badccf945c69fac7f77a216ac169acd786fc2a5096bfcb7046f8b77a01cc7871
SHA512 84f2944438ebfff04773752e78bdb165fc13e7bbd0948c59b2d15b9d48a8da8181724b38113684f6f78f4b94d60a87d49479b30aa82698a5bd4693c0b9b9a19d

C:\Users\Admin\Desktop\WaitSubmit.wav.id[E90ACFBF-3483].[[email protected]].8base

MD5 04d7ea5dd1e382c3b77ec8540733927b
SHA1 22eaeef37977e0a21f218bec765d8a78cf66ac18
SHA256 b3847734eac3bfca1bd3b07cd9bd32c8e0ecaa3cd9891de1d442276594afdf44
SHA512 8a0de3d24e50589f87a5837cc6b99169a80d8136cdfcf4c14f5b5dd035f5403a22f8b0223e297317d1691fd8ed9ba070749c6ce22b0426c46705e318d0528b55

C:\Users\Admin\Desktop\WaitGroup.jpg.id[E90ACFBF-3483].[[email protected]].8base

MD5 60147ffa9cd3a0f3ec6bddebab35e3ed
SHA1 e5998b1a0461702054dae02d1f01051455a5d3f9
SHA256 4bd5cf0c552a42189d5248090778cd30077af8b437ee2cd0e19828075eb3c2f7
SHA512 30d177b74ccbe13e4795ed203a5bdc7188489cabe8716877c4877bfe942f9b46a5aa3ee58abbc9be487e27dcf9452060ace89b021a7df233cc2a67750f84e1df

C:\Users\Admin\Desktop\LimitMeasure.DVR-MS.id[E90ACFBF-3483].[[email protected]].8base

MD5 703f1087e19c7c9882d0a894bba215db
SHA1 2548e123f52d8935fe2b295cf25fa8363aa774b0
SHA256 538f0d2bcd3b046188a58eb968c16885dd5b4abefc41eb5c3890d628358a38f0
SHA512 2e03220c1fa48e20a7e3c8331de4f3746c71915af057cd66ce09679a97276bc95804e5da36390c2b192d8d9a070b6cdc70a0452740f49cb0676957b8758e0b9b

C:\Users\Admin\Desktop\MoveSwitch.ex_.id[E90ACFBF-3483].[[email protected]].8base

MD5 534e12564fa8c8346dd1d02f95a5d304
SHA1 18af52973327652d8e7ad08d083f1c8aeb547fff
SHA256 e0a8a3dced24f6cb0c06249f87258aad22f99fff56e0f30839077917020e5031
SHA512 6a34626c7bf15bf17c9f53d916d2b75e409b5193539994903c37b05b2aca2b35dd199ae6c205cb2be9bea15bb3b56ed16f5d618b30fa6b55c70b6f992f3a087c

C:\Users\Admin\Desktop\FormatSplit.mhtml.id[E90ACFBF-3483].[[email protected]].8base

MD5 73dcf5cc8216a2e81dbdeb8531be61da
SHA1 151e70850dd918fc382f2a95bed12817b151d67d
SHA256 ad260a494b964dd7acc09a0817bf5943110381c2b52759b9c0ed49cfd2f49a32
SHA512 d302e07dcfb7826f209f76a1da000becefb115d3cce2ab81dc757f2e51622233d2231e22c08a0cc0864bef621c13fd988eeb17ca95813911a069e0b7e761a5f6

C:\Users\Admin\Desktop\GetDeny.gif.id[E90ACFBF-3483].[[email protected]].8base

MD5 3c28a44e3be29b34be198776a13737ef
SHA1 6957ed8e3ff3dfd3bf6fe837152fe5a38e1c1222
SHA256 99ba0c0e9d416867485ac486fb8ac0560a75d76a58b85203dfeb53488fad13c1
SHA512 1cb173685ed240b6b0742dc206d0f8da374a29fc0517eaf885090b8e121a0dcab84433b0b0bda20b65314c5339ff63db2b74b1a69fbde29c2b11b96ae7019df3

C:\Users\Admin\Desktop\UnregisterGrant.temp.id[E90ACFBF-3483].[[email protected]].8base

MD5 2080f57c12f22b9ef8b99af2a9a1b608
SHA1 c8fc05ec31a72c46454d43753e7e86f277617366
SHA256 fccd6a7659f99292bfb46dec7c0aab7501d18b3fd1d0404c636121e88073c530
SHA512 cb99d27ee77ec624e990ab7412a07c52f358dbd3fcaff807ef18b19ca167338b3069c79e8adea8a6bc4bc4d783ee71d2d14d9553db59ef7d5043a1af858012ab

C:\Users\Admin\Desktop\UpdateStart.ADT.id[E90ACFBF-3483].[[email protected]].8base

MD5 2b6af5a0a25df1f75bbb92c3752f4d5a
SHA1 f0b8353b4698825b43f7ba0758de9b38a77de143
SHA256 2491c91be992704884cc93944ed429cd5914dfbd4419190ce7865d5d13d60964
SHA512 8b8fbba85984260cfdfe305a786670a3d552c8971481705e8ed243d8a1f1bfaea207f05d77a53bb5d001c835f8645aec81b15a4e916ca4284e4463fbc8158dfd

C:\Users\Admin\Desktop\WaitUndo.mpeg2.id[E90ACFBF-3483].[[email protected]].8base

MD5 51e5ce22f0b80104626f603de665c6eb
SHA1 740ab0d18fcd764f04bc6dcc2f9d404bc24a16ef
SHA256 ae12ba20a118fb0d36178342720fd2ac76512b932d976f51c5d5436a53fe9ce0
SHA512 edb4be4eb7986b01517425676a40329b48f575c31ac69ad4e7b3a2382e18ff10d5eb43095703561bc02905fcbd1ebd9702cf7d7cd0b1e3141b2c01bde58cff8b

C:\Users\Admin\Desktop\ReadJoin.xhtml.id[E90ACFBF-3483].[[email protected]].8base

MD5 6f60b5b70e35cbc25522f01f6cd10806
SHA1 814a27c469e4d2bd93db46f31bcc1238da6d00a0
SHA256 476111df3bce740dec81f65221cb1e88e90276441e8fb48b4ccf58ca40f5cebc
SHA512 6e92ace64d7db7d176f6cd12bda799cb924251d20f5bcfa4315bf673a28ae34b55603d784e451d4c2480f4842f381e7f04709f7dbfb9536dbadbf91dcb7c94e3

C:\Users\Admin\Desktop\RemoveLimit.php.id[E90ACFBF-3483].[[email protected]].8base

MD5 6a7b323f95e726632c88f574f15fc74a
SHA1 61790e922e29f0465f3ae691f0b0af94bcc88148
SHA256 864f325d84810eb5be96857c7d967160831e13c1408228f992a1c78842f2646c
SHA512 6b32bda66d256622d92c6c0f32ff014701d9144d985570dbc9204aab8bab072b7c3b7e10c8ff294ee86c58c57902c8f089b246a20aa7a01546873f5457f59975

C:\Users\Admin\Desktop\RequestBackup.xht.id[E90ACFBF-3483].[[email protected]].8base

MD5 af274424058c4b7d3b53720f1f0f2dc1
SHA1 7fd304f8ffd81782f30d3b919bb1f38eb8cbbb54
SHA256 745d1e577532dd8a2aea6fde5d45f4ac89c0d146f5099dd39161a08a5f40c773
SHA512 8d17ec8ba5633296b8092d923972939732ac460cf80a0a0905793a07c95aa42a5eedf7401a12c4139993dddfbe4223c92338a20d4d17b1b57093a5d1e7a42aa3

C:\Users\Admin\Desktop\ResolveDebug.ogg.id[E90ACFBF-3483].[[email protected]].8base

MD5 fef1d14f152e6beb9af3642e5a9b0002
SHA1 3d8f978a63dbef1900c0375023ebd13d62ef07d8
SHA256 4b537f69a095ba6bbf60508337a809a90b9e873ecf6a71fb2c235ae2561ee2f4
SHA512 3713c88f33da68beab44b3f3ed1bff6a3228267697dab73bc6cbf178eb00e896ec629fc05ddd40f42eb98dec310aa20f92693d45d6b2586d2a582eedb12e7d1e

C:\Users\Admin\Desktop\ResumeCompress.fon.id[E90ACFBF-3483].[[email protected]].8base

MD5 85eb059777080080c7bfc5b4d41b27cb
SHA1 4444109feac8097c2ce443ac4ad1a098fbfcd761
SHA256 3df052d30f569cfff8cc0f35f0bb49024f8ce4f9085635e18cfc822c2207e88b
SHA512 7bc1391a23c600f2827b55a30c491c7f4e27657b67754d6ff8d4020d8c5b2c1d760d413ef393d2c804a982e29cbe4baf79a6920be386e4860285af8d9eb3236d

C:\Users\Admin\Desktop\SkipDisable.mp4.id[E90ACFBF-3483].[[email protected]].8base

MD5 1d5278d20652a3f1717d62a8a1ea96d4
SHA1 dc0154da975158c3f52e080a6a43dcb10fea5304
SHA256 41e16361da74402da67c67730b0f957c9ab0dee778bb6511017491cd4659d0e5
SHA512 be2bdf2d1d98e075b4fb6cad58045d45b1b4b67d360d04e3f9ff9824ece6e1adf506013f41a9332297f4bb5129565ff32ce1333638e4a9ddebb54a54e0e310d7

C:\Users\Admin\Desktop\StepDebug.eps.id[E90ACFBF-3483].[[email protected]].8base

MD5 96f56e633dfd6bdd168b534c89e022aa
SHA1 e86a2a2f7ab85585cbb4b43005c8451b8bbb6467
SHA256 1149b948e945f45b7780e2981cb897570f9ca800e497dc32f0921af9e7877d8a
SHA512 c49075717eb22e58102fa222ae6704ad43c3e55e0ed1f487fca38cb06526ec0524e03e6a42dc594449cd72f2ffe87da61de47a4b36aef4ffb2d99babb92e1d10

C:\Users\Admin\Desktop\UndoSkip.mpeg.id[E90ACFBF-3483].[[email protected]].8base

MD5 4b92dfb37ab2eaebaa625ea40abe8e9a
SHA1 b8f84eaf07069f555ae34a89066b5e50639c300a
SHA256 f004205ff3309a4810a91bc23f75bdec1cd3cb2f7607c55e7540b299d5bc07f8
SHA512 9d87c09436bf62b8428eae3510a5553e9df2fe590ad39735f2cc2be17ed161bdb9550cd66cca7c7c43a69714d3218495d2d6453257f97cb79416ed5dadf39e7b

C:\Users\Admin\Desktop\UnprotectRequest.png.id[E90ACFBF-3483].[[email protected]].8base

MD5 2fa23bfcace5a5a75cda8d34c93c1847
SHA1 11a8e147607efea9af41a5cdc8f6468280fc5353
SHA256 30443ed40bebca95649835958dbd61927e0c63527720971717f51900ec7898e9
SHA512 efdcf602b945e47a7e889552bfcb2521ad157a12e4ae4a8cad64d4ba0a7683ba4dcc8ecf31ea1aa2c1807a85688c0b271dfdc8ac2bd380d897ea7a60b65d85d3

C:\Users\Admin\Desktop\OutCheckpoint.jpeg.id[E90ACFBF-3483].[[email protected]].8base

MD5 eb478e3c635b71b44cecca79fe78b5df
SHA1 b8e93a5f1b43ceee219460aecfcad53dad8e1cb0
SHA256 6ee7a49c456c9fd5eeb832c702223c3a53b922519dfd9da7fad1018576a2fd1b
SHA512 a0ad797ccaa2f4f723c196531ac2d7bf92fa7ce42819c43e06b7242398d7475dfd9e7710c57f99889f21a5e974c2fb77fe7ad3bd5d4923c5deb8c04dc728cd7a

C:\Users\Admin\Desktop\NewCheckpoint.ex_.id[E90ACFBF-3483].[[email protected]].8base

MD5 dd0a1a516bbaecf614f8e47c8f07bff0
SHA1 d87076b825ca357d105b07c437f7b7e3d41bacdc
SHA256 74d8de19cd2d5a0aa08b2eea048de0629d152c7b2821415f28f8c0017b9f3869
SHA512 8faf08f2d606f2858734960f30d07696276274128d862a194b39e65eb943214926776266e9497e2de31ba408e6a4f8b0bff5057159f4196ce4646783e109ac4c

C:\info.hta

MD5 12dab65c45c443b221aee886c4bc6324
SHA1 0c27d3893373c4f7a1fefd59952f423016c2ff2d
SHA256 b2e716acb949b1a066452867d65f8bdfb3404187c6a5f7a95a565682beaab7ca
SHA512 d64089dd1117d21dcdc2b290c32a069d535d71e0c8e97b4e1aa281d47eafce17338d3e224c5326947179d736796b1d3424ba276f1b086dfb16899a81f47c5f2b

C:\Users\Admin\AppData\Local\Temp\AAB1.tmp\aa_nts.log

MD5 3492e68eb6cbdccaf2acd861840ca80d
SHA1 3bdcb568ca0cfa4e84fc2d91c61090e93c67ca0d
SHA256 7d13b22622e1b70881dcb8ac131ba4e414235105f544d3176cdaf81e3c43e55e
SHA512 992e0865c50bf045de89a8cc3d0dcafb2854affea7c63b8ac984ada12ca77b6f98ebdf71820f21cc5274df91a32296f127586d2becac5f95a6b0fb587130c460

Analysis: behavioral2

Detonation Overview

Submitted

2023-09-25 01:38

Reported

2023-09-25 01:43

Platform

win10-20230915-en

Max time kernel

300s

Max time network

303s

Command Line

C:\Windows\Explorer.EXE

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

FlawedAmmyy RAT

trojan flawedammyy

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 5032 created 3192 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (465) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\D201.tmp\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\certreq.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IK} = "C:\\Users\\Admin\\AppData\\Local\\IK}.exe" C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Windows\CurrentVersion\Run\IK} = "C:\\Users\\Admin\\AppData\\Local\\IK}.exe" C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\90C3.exe'\"" C:\Users\Admin\AppData\Local\Temp\90C3.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\$RECYCLE.BIN\S-1-5-21-2445638973-2158012892-84912826-1000\desktop.ini C:\Windows\SysWOW64\explorer.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2445638973-2158012892-84912826-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\D201.tmp\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\gameEnd_background_symbols.jpg C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-tw\ui-strings.js.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationBuildTasks.resources.dll C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\Skins\Revert.wmz C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgrain_plugin.dll C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeHost.Proxies.dll C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\WorldClockMedTile.contrast-white_scale-200.png C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailMediumTile.scale-125.png C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_radio_selected_18.svg C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vreg\wordmui.msi.16.en-us.vreg.dat C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6478_40x40x32.png C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Styling\css\PhoneLight.css C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\ui-strings.js.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp_2x.gif C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-stdio-l1-1-0.dll C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\Klondike\Goal_2.jpg C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\cloud_icon.png.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicTSFrame.png C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\psfontj2d.properties C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Forms.dll.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\ApplicationInsights.config C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarLargeTile.scale-150.png C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\dd_arrow_small.png C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\LAYERS.INF C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\ui-strings.js.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files\Mozilla Firefox\defaultagent_localized.ini.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorStoreLogo.contrast-black_scale-200.png C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\ui-strings.js C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\SplashScreen\SolitaireUpperLeftImage_Large.png C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-64.png C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\example_icons.png.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\cs-cz\ui-strings.js C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\ui-strings.js C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OWSCLT.DLL.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\AppStore_icon.svg.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\Klondike\Tips_3.jpg C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\WideTile.scale-125.png C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\ui-strings.js C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected][1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo.png C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CalibriL.ttf.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEERR.DLL C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\cloud_secured_lg.png C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libfloat_mixer_plugin.dll.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_reject_18.svg C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\msadcer.dll C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONLNTCOMLIB.DLL C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\BingLocalSearchService.dll C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\MSB1XTOR.DLL.id[1DD152BE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Roaming\ctbuubf N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Roaming\ctbuubf N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Roaming\ctbuubf N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8E70.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90C3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\ctbuubf N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\D201.tmp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2968 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
PID 2968 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
PID 2968 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
PID 2968 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
PID 2968 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
PID 2968 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
PID 2968 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
PID 2968 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
PID 5032 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Windows\system32\certreq.exe
PID 5032 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Windows\system32\certreq.exe
PID 5032 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Windows\system32\certreq.exe
PID 5032 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe C:\Windows\system32\certreq.exe
PID 4264 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe
PID 4264 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe
PID 4264 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe
PID 4264 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe
PID 4264 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe
PID 4264 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe
PID 1772 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 1772 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 1772 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 1772 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 1772 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 1772 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 1772 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 1772 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 1772 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 1772 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 4716 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 4716 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 4716 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 4716 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 4716 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 4716 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 4716 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 4716 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 4716 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 4716 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Users\Admin\AppData\Local\Microsoft\IK}.exe
PID 4292 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Windows\system32\cmd.exe
PID 4292 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Windows\system32\cmd.exe
PID 4292 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Windows\system32\cmd.exe
PID 4292 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Microsoft\IK}.exe C:\Windows\system32\cmd.exe
PID 4424 wrote to memory of 2784 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4424 wrote to memory of 2784 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1976 wrote to memory of 4756 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1976 wrote to memory of 4756 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1976 wrote to memory of 4484 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1976 wrote to memory of 4484 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1976 wrote to memory of 704 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1976 wrote to memory of 704 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4424 wrote to memory of 224 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4424 wrote to memory of 224 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1976 wrote to memory of 2408 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1976 wrote to memory of 2408 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1976 wrote to memory of 3752 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1976 wrote to memory of 3752 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3192 wrote to memory of 4640 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\8E70.exe
PID 3192 wrote to memory of 4640 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\8E70.exe
PID 3192 wrote to memory of 4640 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\8E70.exe
PID 3192 wrote to memory of 1996 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\90C3.exe
PID 3192 wrote to memory of 1996 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\90C3.exe
PID 3192 wrote to memory of 1996 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\90C3.exe
PID 4640 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\8E70.exe C:\Users\Admin\AppData\Local\Temp\8E70.exe
PID 4640 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\8E70.exe C:\Users\Admin\AppData\Local\Temp\8E70.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

"C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe"

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe

"C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe"

C:\Users\Admin\AppData\Local\Microsoft\IK}.exe

"C:\Users\Admin\AppData\Local\Microsoft\IK}.exe"

C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe

C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe

C:\Users\Admin\AppData\Local\Microsoft\IK}.exe

C:\Users\Admin\AppData\Local\Microsoft\IK}.exe

C:\Users\Admin\AppData\Local\Microsoft\IK}.exe

"C:\Users\Admin\AppData\Local\Microsoft\IK}.exe"

C:\Users\Admin\AppData\Local\Microsoft\IK}.exe

C:\Users\Admin\AppData\Local\Microsoft\IK}.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Users\Admin\AppData\Local\Temp\8E70.exe

C:\Users\Admin\AppData\Local\Temp\8E70.exe

C:\Users\Admin\AppData\Local\Temp\90C3.exe

C:\Users\Admin\AppData\Local\Temp\90C3.exe

C:\Users\Admin\AppData\Local\Temp\8E70.exe

C:\Users\Admin\AppData\Local\Temp\8E70.exe

C:\Users\Admin\AppData\Local\Temp\8E70.exe

C:\Users\Admin\AppData\Local\Temp\8E70.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\90C3.exe

"C:\Users\Admin\AppData\Local\Temp\90C3.exe"

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\90C3.exe

"C:\Users\Admin\AppData\Local\Temp\90C3.exe"

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\D201.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\D201.tmp\svchost.exe -debug

C:\Windows\SysWOW64\ctfmon.exe

ctfmon.exe

C:\Users\Admin\AppData\Roaming\ctbuubf

C:\Users\Admin\AppData\Roaming\ctbuubf

C:\Users\Admin\AppData\Roaming\ctbuubf

C:\Users\Admin\AppData\Roaming\ctbuubf

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 61.66.131.45.in-addr.arpa udp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 sentrex219.xyz udp
DE 193.31.28.70:80 sentrex219.xyz tcp
US 8.8.8.8:53 120.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 70.28.31.193.in-addr.arpa udp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 rl.ammyy.com udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 254.22.238.8.in-addr.arpa udp
US 8.8.8.8:53 mxstat215dm.xyz udp
DE 45.131.66.83:4044 mxstat215dm.xyz tcp
US 8.8.8.8:53 83.66.131.45.in-addr.arpa udp

Files

memory/2968-0-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2968-1-0x0000000000E40000-0x0000000001026000-memory.dmp

memory/2968-2-0x0000000005A30000-0x0000000005AA8000-memory.dmp

memory/2968-3-0x0000000005B80000-0x0000000005B90000-memory.dmp

memory/2968-4-0x0000000005AE0000-0x0000000005B48000-memory.dmp

memory/2968-5-0x0000000005B90000-0x0000000005BDC000-memory.dmp

memory/2968-6-0x0000000006100000-0x00000000065FE000-memory.dmp

memory/5032-7-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2968-10-0x0000000074080000-0x000000007476E000-memory.dmp

memory/5032-11-0x0000000000400000-0x0000000000473000-memory.dmp

memory/5032-12-0x0000000000400000-0x0000000000473000-memory.dmp

memory/5032-13-0x00000000017E0000-0x00000000017E7000-memory.dmp

memory/5032-14-0x00000000032B0000-0x00000000036B0000-memory.dmp

memory/5032-15-0x00000000032B0000-0x00000000036B0000-memory.dmp

memory/5032-16-0x00000000032B0000-0x00000000036B0000-memory.dmp

memory/5032-17-0x00000000032B0000-0x00000000036B0000-memory.dmp

memory/3820-18-0x000001B367B40000-0x000001B367B43000-memory.dmp

memory/5032-21-0x00000000040B0000-0x00000000040E6000-memory.dmp

memory/5032-27-0x0000000000400000-0x0000000000473000-memory.dmp

memory/5032-28-0x00000000040B0000-0x00000000040E6000-memory.dmp

memory/5032-29-0x00000000032B0000-0x00000000036B0000-memory.dmp

memory/5032-30-0x0000000000400000-0x0000000000473000-memory.dmp

memory/5032-31-0x00000000032B0000-0x00000000036B0000-memory.dmp

memory/3820-33-0x000001B367B40000-0x000001B367B43000-memory.dmp

memory/3820-36-0x000001B367CD0000-0x000001B367CD7000-memory.dmp

memory/3820-37-0x00007FF765950000-0x00007FF765A7F000-memory.dmp

memory/3820-38-0x00007FF765950000-0x00007FF765A7F000-memory.dmp

memory/3820-39-0x00007FF765950000-0x00007FF765A7F000-memory.dmp

memory/3820-40-0x00007FF765950000-0x00007FF765A7F000-memory.dmp

memory/3820-41-0x00007FF765950000-0x00007FF765A7F000-memory.dmp

memory/3820-44-0x00007FF765950000-0x00007FF765A7F000-memory.dmp

memory/3820-46-0x00007FF765950000-0x00007FF765A7F000-memory.dmp

memory/3820-48-0x00007FF765950000-0x00007FF765A7F000-memory.dmp

memory/3820-47-0x00007FF765950000-0x00007FF765A7F000-memory.dmp

memory/3820-49-0x00007FFFB0120000-0x00007FFFB02FB000-memory.dmp

memory/3820-50-0x00007FF765950000-0x00007FF765A7F000-memory.dmp

memory/3820-51-0x00007FF765950000-0x00007FF765A7F000-memory.dmp

memory/3820-52-0x00007FF765950000-0x00007FF765A7F000-memory.dmp

memory/3820-53-0x00007FF765950000-0x00007FF765A7F000-memory.dmp

memory/3820-54-0x00007FF765950000-0x00007FF765A7F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe

MD5 bd1d8db35bac4d386cde9b8da78eb134
SHA1 9a5826db62ab4f64e60a3a953d1f459c8c292373
SHA256 1f84f2b0a0cb1d58761c95b9fca7cff7676bb5c3715e83f59f9aee6dfb4c6431
SHA512 61412c4e6b318f1c37b2c297741437ab4de45b7eabb30754a9bce74d7bca90d0da181d2b9893382450c9b9e951b400b6fde4196f42be6a59b78eebe0e50e3f4c

C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe

MD5 bd1d8db35bac4d386cde9b8da78eb134
SHA1 9a5826db62ab4f64e60a3a953d1f459c8c292373
SHA256 1f84f2b0a0cb1d58761c95b9fca7cff7676bb5c3715e83f59f9aee6dfb4c6431
SHA512 61412c4e6b318f1c37b2c297741437ab4de45b7eabb30754a9bce74d7bca90d0da181d2b9893382450c9b9e951b400b6fde4196f42be6a59b78eebe0e50e3f4c

memory/3820-59-0x00007FFFB0120000-0x00007FFFB02FB000-memory.dmp

memory/4264-58-0x0000000000450000-0x000000000049C000-memory.dmp

memory/4264-62-0x0000000002710000-0x0000000002752000-memory.dmp

memory/4264-60-0x0000000074080000-0x000000007476E000-memory.dmp

memory/4264-63-0x0000000002700000-0x0000000002710000-memory.dmp

memory/4264-64-0x0000000004CE0000-0x0000000004D24000-memory.dmp

memory/4264-65-0x0000000004D20000-0x0000000004D52000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\IK}.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

C:\Users\Admin\AppData\Local\Microsoft\IK}.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

memory/1772-68-0x0000000000D50000-0x0000000000DA0000-memory.dmp

memory/1772-69-0x0000000005510000-0x0000000005554000-memory.dmp

memory/1772-70-0x0000000074080000-0x000000007476E000-memory.dmp

memory/1772-72-0x00000000055E0000-0x0000000005626000-memory.dmp

memory/1772-71-0x0000000005560000-0x0000000005570000-memory.dmp

memory/1772-73-0x0000000005620000-0x0000000005654000-memory.dmp

memory/2124-74-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2124-77-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4264-78-0x0000000074080000-0x000000007476E000-memory.dmp

memory/4292-79-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\L5qoc.exe

MD5 bd1d8db35bac4d386cde9b8da78eb134
SHA1 9a5826db62ab4f64e60a3a953d1f459c8c292373
SHA256 1f84f2b0a0cb1d58761c95b9fca7cff7676bb5c3715e83f59f9aee6dfb4c6431
SHA512 61412c4e6b318f1c37b2c297741437ab4de45b7eabb30754a9bce74d7bca90d0da181d2b9893382450c9b9e951b400b6fde4196f42be6a59b78eebe0e50e3f4c

C:\Users\Admin\AppData\Local\Microsoft\IK}.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

memory/4292-84-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1772-83-0x0000000074080000-0x000000007476E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\IK}.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\IK}.exe.log

MD5 ffe7bf10728fcdc9cfc28d6c2320a6f8
SHA1 af407275e9830d40889da2e672d2e6af118c8cb8
SHA256 72653cc5191f40cf26bcabcb5e0e41e53f23463f725007f74da78e36f9ec1522
SHA512 766753516d36ef1065d29dd982e0b6ee4e84c0c17eb2b0a6ca056f6c8e2a908e53c169bbcb01ab8b9ba1be1463fdd4007398d964aed59de761c1a6213842776c

memory/4716-87-0x0000000074120000-0x000000007480E000-memory.dmp

memory/4716-88-0x0000000005250000-0x0000000005260000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\IK}.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

memory/4716-92-0x0000000074120000-0x000000007480E000-memory.dmp

memory/3256-94-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3820-95-0x000001B367CD0000-0x000001B367CD5000-memory.dmp

memory/3820-96-0x00007FFFB0120000-0x00007FFFB02FB000-memory.dmp

memory/3192-97-0x00000000014D0000-0x00000000014E6000-memory.dmp

memory/2124-98-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4292-101-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4292-111-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4292-112-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4292-113-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4292-115-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4292-118-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4292-122-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4292-149-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4292-125-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4292-241-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4292-229-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4292-135-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4292-121-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[1DD152BE-3483].[[email protected]].8base

MD5 0d8560436d255a088c7b310ec494c0c3
SHA1 9c99a9387a6ce86a867346e3d17d79a0b6fe6389
SHA256 edd75ef29d683dfb8863b3c755d4abcaaed20b00b7f494e6371b26456dbe8205
SHA512 844e8c61df38dfd1b94a8fb01b347c6c34695d65885f33b949d7ed5a34a3c6187638c9a59e4877858ab794beace5a05176083cb674130dd3fa2dcb0b1abc1a77

memory/4292-499-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8E70.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

C:\Users\Admin\AppData\Local\Temp\8E70.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

C:\Users\Admin\AppData\Local\Temp\8E70.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

memory/4640-2873-0x0000000073EE0000-0x00000000745CE000-memory.dmp

memory/4640-2880-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\90C3.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\90C3.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\8E70.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

memory/1996-2918-0x0000000000860000-0x00000000008DC000-memory.dmp

memory/1996-2967-0x0000000073EE0000-0x00000000745CE000-memory.dmp

memory/1996-3016-0x0000000005460000-0x00000000054F2000-memory.dmp

memory/1996-3052-0x0000000005500000-0x000000000559C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8E70.exe

MD5 0ac2f2a139764fadb9cc234b3430a246
SHA1 5896c452a30d4adac37637259c70fbf316c91813
SHA256 207d81c2596a29680411b76b7c0178d33706704fba39c591c65f2fcaba6ac29e
SHA512 c1d613ad3805f745839949caf1c337da2d86f72c93a9af379480cfc059e2c717888bc6063e6b776c68ad3535c24c0eaa6a66c96065093cb5cd51dbc7a1b313e9

memory/4640-3131-0x0000000073EE0000-0x00000000745CE000-memory.dmp

memory/3288-3182-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1996-3207-0x0000000005FC0000-0x0000000005FD0000-memory.dmp

memory/1996-3252-0x0000000005820000-0x0000000005862000-memory.dmp

memory/1996-3311-0x0000000006170000-0x000000000617A000-memory.dmp

memory/3052-3598-0x0000000000A00000-0x0000000000A75000-memory.dmp

memory/3052-3617-0x0000000000760000-0x00000000007CB000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\cookies.sqlite.id[1DD152BE-3483].[[email protected]].8base

MD5 d207de78774cb1ef9b3a6b642e49b691
SHA1 bb1a3850fe624f674e62d242b6c904f3500abb1a
SHA256 225533776f3c08e2797318b8ad2a8683118bff736af5f9f0bf867c441838c0c2
SHA512 92cdcd1597babdc326923e158157c4c1925cfdeb63571740af0eedf201c4dc9871d66eea73294914365d8e8f7be203937fe4bb00a195583496f3cdb9fd38b228

memory/4432-3791-0x00000000001F0000-0x00000000001F7000-memory.dmp

memory/4432-3802-0x00000000001E0000-0x00000000001EC000-memory.dmp

memory/3052-3929-0x0000000000760000-0x00000000007CB000-memory.dmp

memory/1996-3948-0x0000000005FC0000-0x0000000005FD0000-memory.dmp

memory/1504-3964-0x0000000000EA0000-0x0000000000EA4000-memory.dmp

memory/1504-3970-0x0000000000E90000-0x0000000000E99000-memory.dmp

memory/1996-4283-0x0000000073EE0000-0x00000000745CE000-memory.dmp

memory/2448-4299-0x00000000001E0000-0x00000000001EB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\90C3.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\D201.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\D201.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Roaming\ctbuubf

MD5 bd1d8db35bac4d386cde9b8da78eb134
SHA1 9a5826db62ab4f64e60a3a953d1f459c8c292373
SHA256 1f84f2b0a0cb1d58761c95b9fca7cff7676bb5c3715e83f59f9aee6dfb4c6431
SHA512 61412c4e6b318f1c37b2c297741437ab4de45b7eabb30754a9bce74d7bca90d0da181d2b9893382450c9b9e951b400b6fde4196f42be6a59b78eebe0e50e3f4c

C:\Users\Admin\AppData\Roaming\ctbuubf

MD5 bd1d8db35bac4d386cde9b8da78eb134
SHA1 9a5826db62ab4f64e60a3a953d1f459c8c292373
SHA256 1f84f2b0a0cb1d58761c95b9fca7cff7676bb5c3715e83f59f9aee6dfb4c6431
SHA512 61412c4e6b318f1c37b2c297741437ab4de45b7eabb30754a9bce74d7bca90d0da181d2b9893382450c9b9e951b400b6fde4196f42be6a59b78eebe0e50e3f4c

C:\Users\Admin\AppData\Roaming\ctbuubf

MD5 bd1d8db35bac4d386cde9b8da78eb134
SHA1 9a5826db62ab4f64e60a3a953d1f459c8c292373
SHA256 1f84f2b0a0cb1d58761c95b9fca7cff7676bb5c3715e83f59f9aee6dfb4c6431
SHA512 61412c4e6b318f1c37b2c297741437ab4de45b7eabb30754a9bce74d7bca90d0da181d2b9893382450c9b9e951b400b6fde4196f42be6a59b78eebe0e50e3f4c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ctbuubf.log

MD5 ffe7bf10728fcdc9cfc28d6c2320a6f8
SHA1 af407275e9830d40889da2e672d2e6af118c8cb8
SHA256 72653cc5191f40cf26bcabcb5e0e41e53f23463f725007f74da78e36f9ec1522
SHA512 766753516d36ef1065d29dd982e0b6ee4e84c0c17eb2b0a6ca056f6c8e2a908e53c169bbcb01ab8b9ba1be1463fdd4007398d964aed59de761c1a6213842776c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\L5qoc.exe.log

MD5 ffe7bf10728fcdc9cfc28d6c2320a6f8
SHA1 af407275e9830d40889da2e672d2e6af118c8cb8
SHA256 72653cc5191f40cf26bcabcb5e0e41e53f23463f725007f74da78e36f9ec1522
SHA512 766753516d36ef1065d29dd982e0b6ee4e84c0c17eb2b0a6ca056f6c8e2a908e53c169bbcb01ab8b9ba1be1463fdd4007398d964aed59de761c1a6213842776c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8E70.exe.log

MD5 ffe7bf10728fcdc9cfc28d6c2320a6f8
SHA1 af407275e9830d40889da2e672d2e6af118c8cb8
SHA256 72653cc5191f40cf26bcabcb5e0e41e53f23463f725007f74da78e36f9ec1522
SHA512 766753516d36ef1065d29dd982e0b6ee4e84c0c17eb2b0a6ca056f6c8e2a908e53c169bbcb01ab8b9ba1be1463fdd4007398d964aed59de761c1a6213842776c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe.log

MD5 ffe7bf10728fcdc9cfc28d6c2320a6f8
SHA1 af407275e9830d40889da2e672d2e6af118c8cb8
SHA256 72653cc5191f40cf26bcabcb5e0e41e53f23463f725007f74da78e36f9ec1522
SHA512 766753516d36ef1065d29dd982e0b6ee4e84c0c17eb2b0a6ca056f6c8e2a908e53c169bbcb01ab8b9ba1be1463fdd4007398d964aed59de761c1a6213842776c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ctbuubf.log

MD5 ffe7bf10728fcdc9cfc28d6c2320a6f8
SHA1 af407275e9830d40889da2e672d2e6af118c8cb8
SHA256 72653cc5191f40cf26bcabcb5e0e41e53f23463f725007f74da78e36f9ec1522
SHA512 766753516d36ef1065d29dd982e0b6ee4e84c0c17eb2b0a6ca056f6c8e2a908e53c169bbcb01ab8b9ba1be1463fdd4007398d964aed59de761c1a6213842776c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001b.db.id[1DD152BE-3483].[[email protected]].8base

MD5 bd25d4f9cc1a6de9574b6ce5248dc4d8
SHA1 49ce6583590c6f0a328aa7c0bccd3a9e063d683f
SHA256 182fb6d480d434183208860b55bb1319623b32c42fc0e8749891a23aa2867413
SHA512 4a6eb3dd1c25d6ce2899c4eeeccddbe3ca36600dbc8b3e4b0415644422742ed94708ed9c1a477eb4af131a611b27e6633fef50515f2388fa3f93f80503bdac7b

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.mum

MD5 741bc0bd78e3693cb950954aa1bf2e52
SHA1 bd322ece9153b51214eda41bba0c6b803d6caa30
SHA256 a349648c7ac60c4711585d09d0c9012f2c8b96077ccaf957c672b34a05c5ad8d
SHA512 b6dd9a8b794ee35fe99f04f5d78b2168157e3fed76752a98b8a39cc5c567ec23581b5c348da6e149ab28ea0cb89c0c0d0f08545174f01ba9d45a860a4eb73b7c

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~es-ES~10.0.15063.0.cat

MD5 463a0532986607cb1ad6b26e94153c05
SHA1 9aa5b80581530693c1f3cb32a1e107532a2a1a96
SHA256 e07a11415f11c98fa5d6e8fb8baa515be4fd071d3528910273efcbec9e882075
SHA512 a004a39ec97d816f7e2f43cd4b1bd52acbdbc5f358a5bfe6d997bfed223af2b9a9653fee8fb57e0d4ed11135802a49b85a8286a8119996a4ed88c78f641b1f80

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat

MD5 241be6be4b06da4a85f1e110c01427c6
SHA1 42ee3232b1c182159696f66c15800a9878177bfb
SHA256 1ee08c4f17b4c7bebf42a09f6c5d8cf09257218b30bede48db3045fc8c07bb8f
SHA512 71df8d3d84393abd418b9c498960b3faf90d85caf60905961482b3c22c200782f55b6f69e23552c3938fe241baba6ad5d012038890f4ee882a0b824f4e091664

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~ja-JP~10.0.15063.0.mum

MD5 47ddc67f27f9e7d00e60b68be2ef1fd8
SHA1 6b804bbe0bfd5b15c86c7f2b01a3bd72c1d3e63e
SHA256 ae7030129ca67d8b57025cd91cf9978b9dbf7d4446420a846bee00c1ac6da75b
SHA512 dc9616d7f532d58de72375e913de1aac3dd2c953728288fedb95f491b8f04bd25b7c22c0fe28c87e0ff9465b7f1acf77ae64cb3f0dda87dc642b04ea8328f309

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~ja-JP~10.0.15063.0.cat

MD5 d93ac1e6d7078f07ab83a2c96dfc71d9
SHA1 5326a1b1b3c9b950134b3d05a755355b07881a2b
SHA256 0e44999d33b50a526870b2d7210e7abd46696dc469a698fc52372104169098f6
SHA512 cab43acf474ec02753d0fd062791bad49b46bb63e1968b00eed566b7fc9cd73f089a84817f741ece99a895ea59206041904e68bc8a68ad6ff6287d5687c786fd

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~it-IT~10.0.15063.0.mum

MD5 b62ccf58661ccf5f36e5150711bbfe1b
SHA1 ba057cf26ebcc7b3951ac44b58637ea3d9d2e516
SHA256 d8be26c66596f9f4a4ce5776d22d686dd31abd1bb5c659cb2d75faeb7e3e14d1
SHA512 3b10394f954621bf7c5add004fd3bef18c9ebba5765122358bf9015788f31cba1f334efcdfcd913d7351fa03d4e8f89f11ccb93dbd1ac9bc7bbfadaa654a9dd8

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~it-IT~10.0.15063.0.cat

MD5 1ece20c692f338709ea3b121feb5ad38
SHA1 e5eb5b5cc4acb056088c6874e8b415d5c72c4d63
SHA256 7240a7307734a427de9afecd44929e13ae4d2bb1d1ea7c45806b809d43ac7d4a
SHA512 c7cb73e3bf8504860546c365b2d2ce112855f5b7d746c6ae889e21f0cfa9abead94dfe090268fd9e07314cb292a9ade5f6b7a37e7bfeea15c1b740c5bccdbdcf

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~fr-FR~10.0.15063.0.mum

MD5 1d420956e62d902c9bd65a62ba34bc2b
SHA1 fc917590f656b79d5d55112926dfa8e8e5635f45
SHA256 a29100bbcc276666b7182bf3b41cf6ddc1cac090dbc109f7674f2b46027fd67c
SHA512 c63177c1615d7635eb3eb13b55d67543954409acd06f19467c0bc20981278866fc3edd07cecf75c9d2256734fd315f05eb5f5f5f646e3960d89f5a969d3ca981

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~fr-FR~10.0.15063.0.cat

MD5 8f1ab8d6a77c7c01da26f26ddfe8b0f6
SHA1 4cae8a293cdf2b439dcd915ab070d9d94855411e
SHA256 f21e412d461eb8138fdc0f4f25d66882deed8c2498a2cbd764de5be116548a52
SHA512 17204b39b08a1275962949acb45b8f12d2d9f57ce49b16d369c58630fa185ac213ed87590dd8bc438e6bc1d477460c604bc346608744e526180b50c6f5e0a5aa

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~es-ES~10.0.15063.0.mum

MD5 ac62b24ee1c94ba09ff3b85bba930bf2
SHA1 9a9aa17c629d9e2dc09078764f59f081f69bebab
SHA256 a044c0e9036e355cc530e88831cbbe60165477929d0f838c786a513937ff1628
SHA512 1168537c3a9b92c8534434f8cf68a3d4d95a48086beb194c68519db9b65f3f57706a678bb7accf085b9f121c069a8c1fae78a1a64df853fb039a761efebf130d

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat

MD5 be70c63aeccef9f4c5175a8741b13b69
SHA1 c5ef2591b7f1df2ecbca40219d2513d516825e9a
SHA256 d648d365d08a7c503edc75535a58f15b865f082b49355254d539a41bf3af87ff
SHA512 b93bf53a5c71a587df7b59fdcaf8046c47e5d82838666ca12e6f56e26c0b9223edf7bf3dbb9352d5718486c531e34a060a05d7924896ab3b6d370dd4ef262186

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~de-DE~10.0.15063.0.mum

MD5 f82f048efc3466bd287ecaa6f5a2d679
SHA1 9eedd9499deae645ffe402eb50361e83def12f14
SHA256 e35cd2ee9eae753175b9b88e032d4973672ff5677b9b7b79eaff1839e0c3044c
SHA512 5cc7337eebc480c482d56a8a5a2c788daa5c4e0370dc33d612caf59c65757cfa7cfc3cbb3321a7e01c6bb97e827962c4d156cfa661ea0b230a43e67940c81230

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\servicing\Packages\Microsoft-OneCore-Wallet-Package~31bf3856ad364e35~amd64~de-DE~10.0.15063.0.cat

MD5 6523a368322f50d964b00962f74b3f65
SHA1 5f360ae5b5b5e76f390e839cf1b440333506e4e8
SHA256 652687424e20a2d6c16ea15ae653150467cfae4993d5ca28dc30106ff8a0ca67
SHA512 210737efc4e2775f261b0dc00ca1ad2aa1a7630633688c5bb9190fa5ff791e9757bbae190f4f7e931f8a4c7e4acf1effce479fdafd3952777ee40d08bdf1c046

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe

MD5 a4bd1ce8b5026e59037a3903cd6e4e3a
SHA1 352243b758a585cf869cd9f9354cd302463f4d9d
SHA256 39d69cd43e452c4899dbf1aa5b847c2a2d251fb8e13df9232ebdb5f0fdc3594c
SHA512 c86901a1bdcebc5721743fca6ac7f1909b64518e046752f3b412183db940563c088e0ec12613ad0b763c814bc3b6bf99dd3b6f8a6bce54add30a10d29e38400c

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.dll

MD5 49ba729dd7ad347eb8ad44dcc3f20de4
SHA1 36bfc3b216daa23e7c3a1e89df88ca533ad878d1
SHA256 88fd9d7794d1e0549facf9534da6abcb3db4be57e2fd045f678b621f7f5a6f3d
SHA512 c7a6750d34e85534fdf3be543a12340de9623ed7c094b9f8f8dd8e7f7308406e5ee90fe7b3c147b170ed67948bb875f72ad5035ecde3f608843fa74d19f9bf0b

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.Background.winmd

MD5 64d3f93322e5e6932ad162365441301d
SHA1 832e1b6e6560f8dae2b8282b72a1d80545ea5891
SHA256 df52db081c34a78391d85832bcb2190a9417fb34e468d5f15e84ac1916a085cc
SHA512 86b8e1f699321c6eb187b597a08bdfdd4b47686681e495783b981ca82cfaaa8be22d1775143cfd0a6d3c7b381b419930609c8370e67a906eba9e1b6a5024eb20

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletWide310x150Logo.scale-200.png

MD5 52bf805c4241200c576401a59f9e211a
SHA1 a10074a87d7c244fcee9b8d45005673aa48140a1
SHA256 adee2dfff644b55f272b54cd8742e886a2bb21623c4f1e6b3058ccf97588d87c
SHA512 9142a45cc68422a51e84ad58858409e7fe711cd120565f0d36d3e7b3f7e9a771e83549d9d852f708a41a511fc0a1989a0315b141ddc122b014f533b0466ad688

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletStoreLogo.png

MD5 08de9d6a366fb174872e8043e2384099
SHA1 955114d06eefae5e498797f361493ee607676d95
SHA256 0289105cf9484cf5427630866c0525b60f6193dea0afacd0224f997ce8103861
SHA512 59004a4920d5e3b80b642c285ff649a2ee5c52df25b6209be46d2f927a9c2ab170534ea0819c7c70292534ee08eb90e36630d11da18edba502776fac42872ed0

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletSquare44x44Logo.targetsize-24_altform-unplated.png

MD5 2bb84fb822fe6ed44bf10bbf31122308
SHA1 e9049ca6522a736d75fc85b3b16a0ad0dc271334
SHA256 afb6768acc7e2229c7566d68dabf863bafdb8d59e2cca45f39370fc7261965dc
SHA512 1f24ca0e934881760a94c1f90d31ef6ccbab165d39c0155fb83b31e92abe4e5e3b70f49189f75d8cdd859796a55312f27c71fda0b8296e8cf30167a02d7391f5

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletSquare44x44Logo.scale-200.png

MD5 1572efa3e47162a7b2198893a362b803
SHA1 a291f6f1cae15d03d5ef0f748b83bee024aa2fca
SHA256 d39fb03894ed83d57acf16976ae256c9912bd7e9feb63cb5c85709e1617e90dc
SHA512 4267d64626b808e9b338d973335794a5b3c3586c26fb0d11c96b07c2ad551486150449d83d5ae2756451c32365a8877a0c59592e5b173a27142464787de7ff45

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletSquare150x150Logo.scale-200.png

MD5 0262d1daca4c1c1e22dec63b012e3641
SHA1 609258b00f17f2a9dd586fe5a7e485573ef477c9
SHA256 8b0ccafcace92ee624e057fa91550d306efd5dc21bb0c850c174ef38d79754fc
SHA512 a1ad7e32bfabfa4ecf32be9ab96db5c84ecf48a8b8a6e267cb106281e119669fed0fb12eaea024e21aa2f13de8f14fa0b805f869b53ec85524b60dc1db7743d0

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletSplashScreen.png

MD5 52bf805c4241200c576401a59f9e211a
SHA1 a10074a87d7c244fcee9b8d45005673aa48140a1
SHA256 adee2dfff644b55f272b54cd8742e886a2bb21623c4f1e6b3058ccf97588d87c
SHA512 9142a45cc68422a51e84ad58858409e7fe711cd120565f0d36d3e7b3f7e9a771e83549d9d852f708a41a511fc0a1989a0315b141ddc122b014f533b0466ad688

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletLockScreenLogo.scale-200.png

MD5 541abea8b402b4ddd7463b2cd1bf54ec
SHA1 e0bfa993adcc35d6cc955be49c2f952529660ad5
SHA256 d436906bb661ba5d0ae3ad2d949b709f92bf50eb79a9faedd7f66d5598e07f16
SHA512 b22478881f719ac94392ef43dbf553c4644e2b3676191cb35c7bd212f496978e5b4e15869d254b96a393314a30e2ce397a6d6bf44cac45a2eff38d997b40c7f6

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml

MD5 44628eb64853341f7678ec488959efe2
SHA1 60e37cb04f7941b6070d3ce035af3d434c78fbfd
SHA256 f44e196695dffbc9442ab694343447097b8362fccaf4269057890f39da50df2e
SHA512 0134c598e3ada0a5ae47c9803b1c0f248d88a92c5fd79dd2baea7dea82322ff52f8b218be41bd3b72f270fe170ad36df5106d2f21ca51be5f8f3c6791da9d86f

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml

MD5 5b333e85c957925ec5f7ae9c47872020
SHA1 97431745824321574e6e6c9666e79147b5a6ea67
SHA256 c2c28b18a9bbe65c7f29640ec18d5836fa51ce720b336dc6e44d49ff2d807d08
SHA512 377b42d7a432c597cbf41c5c9f4303592f88a3fef368e53532ec1474529d5d915f264ca1f099c269a4d4bc35fea22d35140d45c099f4fdb66be8cb109b533f80

C:\Users\Admin\AppData\Local\Temp\BFF0\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml

MD5 44628eb64853341f7678ec488959efe2
SHA1 60e37cb04f7941b6070d3ce035af3d434c78fbfd
SHA256 f44e196695dffbc9442ab694343447097b8362fccaf4269057890f39da50df2e
SHA512 0134c598e3ada0a5ae47c9803b1c0f248d88a92c5fd79dd2baea7dea82322ff52f8b218be41bd3b72f270fe170ad36df5106d2f21ca51be5f8f3c6791da9d86f

C:\Users\Admin\AppData\Local\Temp\BFF0\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml

MD5 5b333e85c957925ec5f7ae9c47872020
SHA1 97431745824321574e6e6c9666e79147b5a6ea67
SHA256 c2c28b18a9bbe65c7f29640ec18d5836fa51ce720b336dc6e44d49ff2d807d08
SHA512 377b42d7a432c597cbf41c5c9f4303592f88a3fef368e53532ec1474529d5d915f264ca1f099c269a4d4bc35fea22d35140d45c099f4fdb66be8cb109b533f80

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe

MD5 a4bd1ce8b5026e59037a3903cd6e4e3a
SHA1 352243b758a585cf869cd9f9354cd302463f4d9d
SHA256 39d69cd43e452c4899dbf1aa5b847c2a2d251fb8e13df9232ebdb5f0fdc3594c
SHA512 c86901a1bdcebc5721743fca6ac7f1909b64518e046752f3b412183db940563c088e0ec12613ad0b763c814bc3b6bf99dd3b6f8a6bce54add30a10d29e38400c

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.dll

MD5 49ba729dd7ad347eb8ad44dcc3f20de4
SHA1 36bfc3b216daa23e7c3a1e89df88ca533ad878d1
SHA256 88fd9d7794d1e0549facf9534da6abcb3db4be57e2fd045f678b621f7f5a6f3d
SHA512 c7a6750d34e85534fdf3be543a12340de9623ed7c094b9f8f8dd8e7f7308406e5ee90fe7b3c147b170ed67948bb875f72ad5035ecde3f608843fa74d19f9bf0b

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.Background.winmd

MD5 64d3f93322e5e6932ad162365441301d
SHA1 832e1b6e6560f8dae2b8282b72a1d80545ea5891
SHA256 df52db081c34a78391d85832bcb2190a9417fb34e468d5f15e84ac1916a085cc
SHA512 86b8e1f699321c6eb187b597a08bdfdd4b47686681e495783b981ca82cfaaa8be22d1775143cfd0a6d3c7b381b419930609c8370e67a906eba9e1b6a5024eb20

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletWide310x150Logo.scale-200.png

MD5 52bf805c4241200c576401a59f9e211a
SHA1 a10074a87d7c244fcee9b8d45005673aa48140a1
SHA256 adee2dfff644b55f272b54cd8742e886a2bb21623c4f1e6b3058ccf97588d87c
SHA512 9142a45cc68422a51e84ad58858409e7fe711cd120565f0d36d3e7b3f7e9a771e83549d9d852f708a41a511fc0a1989a0315b141ddc122b014f533b0466ad688

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletStoreLogo.png

MD5 08de9d6a366fb174872e8043e2384099
SHA1 955114d06eefae5e498797f361493ee607676d95
SHA256 0289105cf9484cf5427630866c0525b60f6193dea0afacd0224f997ce8103861
SHA512 59004a4920d5e3b80b642c285ff649a2ee5c52df25b6209be46d2f927a9c2ab170534ea0819c7c70292534ee08eb90e36630d11da18edba502776fac42872ed0

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletSquare44x44Logo.targetsize-24_altform-unplated.png

MD5 2bb84fb822fe6ed44bf10bbf31122308
SHA1 e9049ca6522a736d75fc85b3b16a0ad0dc271334
SHA256 afb6768acc7e2229c7566d68dabf863bafdb8d59e2cca45f39370fc7261965dc
SHA512 1f24ca0e934881760a94c1f90d31ef6ccbab165d39c0155fb83b31e92abe4e5e3b70f49189f75d8cdd859796a55312f27c71fda0b8296e8cf30167a02d7391f5

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletSquare44x44Logo.scale-200.png

MD5 1572efa3e47162a7b2198893a362b803
SHA1 a291f6f1cae15d03d5ef0f748b83bee024aa2fca
SHA256 d39fb03894ed83d57acf16976ae256c9912bd7e9feb63cb5c85709e1617e90dc
SHA512 4267d64626b808e9b338d973335794a5b3c3586c26fb0d11c96b07c2ad551486150449d83d5ae2756451c32365a8877a0c59592e5b173a27142464787de7ff45

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletSquare150x150Logo.scale-200.png

MD5 0262d1daca4c1c1e22dec63b012e3641
SHA1 609258b00f17f2a9dd586fe5a7e485573ef477c9
SHA256 8b0ccafcace92ee624e057fa91550d306efd5dc21bb0c850c174ef38d79754fc
SHA512 a1ad7e32bfabfa4ecf32be9ab96db5c84ecf48a8b8a6e267cb106281e119669fed0fb12eaea024e21aa2f13de8f14fa0b805f869b53ec85524b60dc1db7743d0

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletSplashScreen.png

MD5 52bf805c4241200c576401a59f9e211a
SHA1 a10074a87d7c244fcee9b8d45005673aa48140a1
SHA256 adee2dfff644b55f272b54cd8742e886a2bb21623c4f1e6b3058ccf97588d87c
SHA512 9142a45cc68422a51e84ad58858409e7fe711cd120565f0d36d3e7b3f7e9a771e83549d9d852f708a41a511fc0a1989a0315b141ddc122b014f533b0466ad688

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletLockScreenLogo.scale-200.png

MD5 541abea8b402b4ddd7463b2cd1bf54ec
SHA1 e0bfa993adcc35d6cc955be49c2f952529660ad5
SHA256 d436906bb661ba5d0ae3ad2d949b709f92bf50eb79a9faedd7f66d5598e07f16
SHA512 b22478881f719ac94392ef43dbf553c4644e2b3676191cb35c7bd212f496978e5b4e15869d254b96a393314a30e2ce397a6d6bf44cac45a2eff38d997b40c7f6

C:\info.hta

MD5 442ac1c916b58bd893a88c4ba0a8a72a
SHA1 f3154d6cd2fb5b08dbc3b7a1e76582f7047c2043
SHA256 dd2873d77a4db6e4b80c4be8f35603c58ee1385e814a592f47bbe673db952031
SHA512 420ccdc6a9c39803b3a581fcb35a1cceb7227ef3706eaa2422eb6dbae441bad6026bf38ca3084564d368fc3b121e322ab7e2092348e1fab2c365c40129137ab7

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\WinSxS\wow64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.15063.0_none_5f8e4354b974f702\WalletBackgroundServiceProxy.dll

MD5 d3c040e9217f31648250f4ef718fa13d
SHA1 72e1174edd4ee04b9c72e6d233af0b83fbfc17dc
SHA256 52e4a039e563ee5b63bbf86bdaf28c2e91c87947f4edeebb42691502cb07cbd7
SHA512 e875f1ff68a425567024800c6000a861275c5b882f671178ca97d0dbf0dda2bdd832f38f02138a16817871aa2ddb154998987efc4a9b49ccaac6a22a9713a3d7

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\WinSxS\wow64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.15063.0_none_c4bc07330185781a\WalletProxy.dll

MD5 590c906654ff918bbe91a14daac58627
SHA1 f598edc38b61654f12f57ab1ddad0f576fe74d0d
SHA256 5d37fbfe7320aa0e215be9d8b05d77a0f5ace2deec010606b512572af2bb4dfc
SHA512 98a50429b039f98dd9adda775e7d2a0d51bb2beea2452247a2041e1f20b3f13b505bcdeecd833030bbecb58f74a82721cc577932dec086fff64ecef5432e8f9a

C:\Users\Admin\AppData\Local\Temp\BFF0\C\Windows\WinSxS\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.15063.0_none_e6c3164a2494c88b\Windows.ApplicationModel.Wallet.dll

MD5 6161c69d5d0ea175d6c88d7921e41385
SHA1 088b440405ddba778df1736b71459527aca63363
SHA256 8128dff83791b26a01ce2146302f1d8b1159f4943844ab325522cf0fc1e2597e
SHA512 cba6e3d1fcb3147193adde3b0f4a95848996999180b59e7bdf16e834e055261cf53548c3972e84d81f840d862c5af53d44945cf4319f24705aecc7d47d1cda07

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db

MD5 ae6fbded57f9f7d048b95468ddee47ca
SHA1 c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA256 d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
SHA512 f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

MD5 b75b16fa4890e5563d5d207c384d48e0
SHA1 48a6ef84a2af7406a822a9c4cd0f1bc3b0fa8339
SHA256 06bba92573ed30d64858bcca6a1f666bacfcbf8faf8f83b10b892d1202e760c1
SHA512 c1328e60074be5a7372fb319c7530fcdbaf7d6c2d0845b4eb8a0c7a79a8d743bc4c6d066b93b7843844e874a7c05fb84ff0e0ede4268b46baa98c0a2176da9b2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db

MD5 122909463c9891b2b70ffdadca529e81
SHA1 0950a155be0f96a9087a847d0d77ecbccaf2aa0e
SHA256 ae3a5cdb9031dab6a44cca294517b5bb11628e1a5bc513f63cc50e6cc7731baf
SHA512 bb4db503cf277b8e1fb6bd2895d7f2f014f37ea95c6c68a982ea07f147bdd6249b1656266d16406b1e8043e230ca186ae45d81b4e60a91098b60d5940ccb59a1

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg

MD5 2257fa8cef64a74c33655bd5f74ef5e5
SHA1 b9f8baf96166f99cb1983563e632e6e69984ad5c
SHA256 ead48b70e048de6ccca219a229ca90b49a9d1b9c14bf3a7c5eaad544294fcfd3
SHA512 7792be9b935a46a923e97bb76b76957070e116dcc4cb6fcd8b883c2d6f142285ebc9fd26cdf29bd19c8bdff412487f586abaa1724332b613e71afa45d7f3e4f9