Malware Analysis Report

2024-10-16 05:10

Sample ID 230928-x6rkrsdh2z
Target 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
Tags
ammyyadmin flawedammyy phobos rhadamanthys smokeloader backdoor bootkit collection evasion persistence ransomware rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636

Threat Level: Known bad

The file 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe was found to be: Known bad.

Malicious Activity Summary

ammyyadmin flawedammyy phobos rhadamanthys smokeloader backdoor bootkit collection evasion persistence ransomware rat spyware stealer trojan

SmokeLoader

Detect rhadamanthys stealer shellcode

Rhadamanthys

FlawedAmmyy RAT

Phobos

Suspicious use of NtCreateUserProcessOtherParentProcess

Ammyy Admin

AmmyyAdmin payload

Renames multiple (469) files with added filename extension

Modifies boot configuration data using bcdedit

Deletes shadow copies

Deletes backup catalog

Blocklisted process makes network request

Modifies Windows Firewall

Downloads MZ/PE file

Executes dropped EXE

Drops startup file

Checks computer location settings

Reads user/profile data of web browsers

Loads dropped DLL

Writes to the Master Boot Record (MBR)

Adds Run key to start application

Accesses Microsoft Outlook profiles

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

outlook_office_path

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious behavior: MapViewOfSection

Uses Volume Shadow Copy service COM API

Interacts with shadow copies

Suspicious use of WriteProcessMemory

outlook_win_path

Checks SCSI registry key(s)

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-09-28 19:28

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-09-28 19:28

Reported

2023-09-28 19:30

Platform

win10v2004-20230915-en

Max time kernel

150s

Max time network

157s

Command Line

C:\Windows\Explorer.EXE

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

FlawedAmmyy RAT

trojan flawedammyy

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3940 created 2564 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (469) files with added filename extension

ransomware

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\rundll32.exe N/A

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\B561.tmp\svchost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\(yw3t = "C:\\Users\\Admin\\AppData\\Local\\(yw3t.exe" C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\(yw3t = "C:\\Users\\Admin\\AppData\\Local\\(yw3t.exe" C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2890696111-2332180956-3312704074-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\B561.tmp\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\iw_get.svg C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files\Java\jre1.8.0_66\bin\j2pcsc.dll.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-BOLD.TTF C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\load-typekit.js C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\libeay32.dll.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\az_get.svg C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_Safety_Objects.jpg C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\fr.pak.DATA C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Cryptomining C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-256_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\Added.txt.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\MSFT_PackageManagementSource.strings.psd1 C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\assets\back-icon.png C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files\Mozilla Firefox\updater.exe.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\beta.identity_helper.exe.manifest C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkServerCP.bat.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\dt_shmem.dll.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-256_altform-unplated.png C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\ECLIPSE.ELM.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp3.scale-125.png C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_up_hover_18.svg.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\PlayStore_icon.svg C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\es.txt C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36.png C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Search.api C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\sample-thumb.png.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons.png C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\msgfilt.dll.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\vcruntime140.dll C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-16_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\ui-strings.js.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-lightunplated.png C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-36_altform-unplated.png C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.winmd C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.scale-400.png C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sk-sk\ui-strings.js C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\ui-strings.js.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\msadc\en-US\msaddsr.dll.mui C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-125.png C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\help.svg.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\ui-strings.js C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\msedge_7z.data C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\jfluid-server-15.jar.id[1708EF3E-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\Csb.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\Csb.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\Csb.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Csb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Csb.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Csb.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6E94.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7328.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\B561.tmp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1904 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 1904 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 1904 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 1904 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 1904 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 1904 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 1904 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 1904 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3940 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Windows\system32\certreq.exe
PID 3940 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Windows\system32\certreq.exe
PID 3940 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Windows\system32\certreq.exe
PID 3940 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Windows\system32\certreq.exe
PID 4744 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 4744 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 4744 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 4744 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 4744 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 4744 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 4744 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 4744 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 4744 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 4744 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 3408 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Microsoft\Csb.exe C:\Users\Admin\AppData\Local\Microsoft\Csb.exe
PID 3408 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Microsoft\Csb.exe C:\Users\Admin\AppData\Local\Microsoft\Csb.exe
PID 3408 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Microsoft\Csb.exe C:\Users\Admin\AppData\Local\Microsoft\Csb.exe
PID 3408 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Microsoft\Csb.exe C:\Users\Admin\AppData\Local\Microsoft\Csb.exe
PID 3408 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Microsoft\Csb.exe C:\Users\Admin\AppData\Local\Microsoft\Csb.exe
PID 3408 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Microsoft\Csb.exe C:\Users\Admin\AppData\Local\Microsoft\Csb.exe
PID 3912 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 3912 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 3912 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 3912 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 3912 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 3912 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 3912 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 3912 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 3912 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 3912 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe
PID 4524 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Windows\system32\cmd.exe
PID 4524 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Windows\system32\cmd.exe
PID 4524 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Windows\system32\cmd.exe
PID 4524 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe C:\Windows\system32\cmd.exe
PID 3960 wrote to memory of 3744 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3960 wrote to memory of 3744 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4448 wrote to memory of 4224 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4448 wrote to memory of 4224 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3960 wrote to memory of 1664 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3960 wrote to memory of 1664 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3960 wrote to memory of 4968 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3960 wrote to memory of 4968 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3960 wrote to memory of 756 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3960 wrote to memory of 756 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3960 wrote to memory of 2136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3960 wrote to memory of 2136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 4448 wrote to memory of 4172 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4448 wrote to memory of 4172 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2564 wrote to memory of 288 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\6E94.exe
PID 2564 wrote to memory of 288 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\6E94.exe
PID 2564 wrote to memory of 288 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\6E94.exe
PID 2564 wrote to memory of 4620 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\7328.exe
PID 2564 wrote to memory of 4620 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\7328.exe
PID 2564 wrote to memory of 4620 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\7328.exe
PID 288 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\6E94.exe C:\Users\Admin\AppData\Local\Temp\6E94.exe
PID 288 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\6E94.exe C:\Users\Admin\AppData\Local\Temp\6E94.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

"C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe"

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe

"C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe"

C:\Users\Admin\AppData\Local\Microsoft\Csb.exe

"C:\Users\Admin\AppData\Local\Microsoft\Csb.exe"

C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe

C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe

C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe

"C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe"

C:\Users\Admin\AppData\Local\Microsoft\Csb.exe

C:\Users\Admin\AppData\Local\Microsoft\Csb.exe

C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe

C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Users\Admin\AppData\Local\Temp\6E94.exe

C:\Users\Admin\AppData\Local\Temp\6E94.exe

C:\Users\Admin\AppData\Local\Temp\7328.exe

C:\Users\Admin\AppData\Local\Temp\7328.exe

C:\Users\Admin\AppData\Local\Temp\6E94.exe

C:\Users\Admin\AppData\Local\Temp\6E94.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Users\Admin\AppData\Local\Temp\7328.exe

"C:\Users\Admin\AppData\Local\Temp\7328.exe"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\B561.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\B561.tmp\svchost.exe -debug

C:\Windows\SYSTEM32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\B561.tmp\aa_nts.dll",run

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 54.120.234.20.in-addr.arpa udp
US 8.8.8.8:53 155.245.36.23.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 61.66.131.45.in-addr.arpa udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 254.177.238.8.in-addr.arpa udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 mkstat227.xyz udp
DE 185.234.72.182:80 mkstat227.xyz tcp
US 8.8.8.8:53 120.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 182.72.234.185.in-addr.arpa udp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.242:443 tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 148.129.42.188.in-addr.arpa udp
US 8.8.8.8:53 242.104.243.136.in-addr.arpa udp
US 8.8.8.8:53 www.ammyy.com udp
DE 136.243.18.118:80 www.ammyy.com tcp
US 8.8.8.8:53 118.18.243.136.in-addr.arpa udp
DE 136.243.18.118:443 www.ammyy.com tcp
US 8.8.8.8:53 147.174.42.23.in-addr.arpa udp
US 8.8.8.8:53 147.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 59.189.79.40.in-addr.arpa udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
DE 85.10.193.215:80 tcp

Files

memory/1904-0-0x00000000009E0000-0x0000000000BC6000-memory.dmp

memory/1904-1-0x0000000075160000-0x0000000075910000-memory.dmp

memory/1904-2-0x00000000056F0000-0x0000000005768000-memory.dmp

memory/1904-3-0x00000000057E0000-0x00000000057F0000-memory.dmp

memory/1904-4-0x0000000005770000-0x00000000057D8000-memory.dmp

memory/1904-5-0x00000000030D0000-0x000000000311C000-memory.dmp

memory/1904-6-0x0000000005DD0000-0x0000000006374000-memory.dmp

memory/3940-7-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1904-11-0x0000000075160000-0x0000000075910000-memory.dmp

memory/3940-10-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3940-12-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3940-13-0x0000000000BF0000-0x0000000000BF7000-memory.dmp

memory/3940-14-0x0000000002870000-0x0000000002C70000-memory.dmp

memory/3940-15-0x0000000002870000-0x0000000002C70000-memory.dmp

memory/3940-16-0x0000000002870000-0x0000000002C70000-memory.dmp

memory/3940-17-0x0000000002870000-0x0000000002C70000-memory.dmp

memory/1872-18-0x000001AFB5A90000-0x000001AFB5A93000-memory.dmp

memory/3940-19-0x00000000036C0000-0x00000000036F6000-memory.dmp

memory/3940-25-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3940-27-0x0000000002870000-0x0000000002C70000-memory.dmp

memory/3940-26-0x00000000036C0000-0x00000000036F6000-memory.dmp

memory/3940-28-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3940-29-0x0000000002870000-0x0000000002C70000-memory.dmp

memory/1872-30-0x000001AFB5A90000-0x000001AFB5A93000-memory.dmp

memory/1872-31-0x000001AFB5D30000-0x000001AFB5D37000-memory.dmp

memory/1872-32-0x00007FF48C4D0000-0x00007FF48C5FF000-memory.dmp

memory/1872-33-0x00007FF48C4D0000-0x00007FF48C5FF000-memory.dmp

memory/1872-34-0x00007FF48C4D0000-0x00007FF48C5FF000-memory.dmp

memory/1872-35-0x00007FF48C4D0000-0x00007FF48C5FF000-memory.dmp

memory/1872-36-0x00007FF48C4D0000-0x00007FF48C5FF000-memory.dmp

memory/1872-38-0x00007FF48C4D0000-0x00007FF48C5FF000-memory.dmp

memory/1872-40-0x00007FF48C4D0000-0x00007FF48C5FF000-memory.dmp

memory/1872-41-0x00007FF48C4D0000-0x00007FF48C5FF000-memory.dmp

memory/1872-42-0x00007FF48C4D0000-0x00007FF48C5FF000-memory.dmp

memory/1872-43-0x00007FFB967F0000-0x00007FFB969E5000-memory.dmp

memory/1872-44-0x00007FF48C4D0000-0x00007FF48C5FF000-memory.dmp

memory/1872-45-0x00007FF48C4D0000-0x00007FF48C5FF000-memory.dmp

memory/1872-46-0x00007FF48C4D0000-0x00007FF48C5FF000-memory.dmp

memory/1872-47-0x00007FF48C4D0000-0x00007FF48C5FF000-memory.dmp

memory/1872-48-0x00007FF48C4D0000-0x00007FF48C5FF000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe

MD5 3eef989524d6cbfc300edb40e13832b1
SHA1 a6978138ef84fd3f190a7d42b1b642e4e29cc8b1
SHA256 c4956ec15632c64ce4fdf60ac74cb02321a70e6b6cd6210499664f3a5038841e
SHA512 9837b6a05688b1474741a7f18b9deaf0e3c903a9dd4575fda84802e6708192e04e684fea0a5035ecd8aa55eca7176351b9c8e534be4a04f9f6abab86069ff235

C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe

MD5 3eef989524d6cbfc300edb40e13832b1
SHA1 a6978138ef84fd3f190a7d42b1b642e4e29cc8b1
SHA256 c4956ec15632c64ce4fdf60ac74cb02321a70e6b6cd6210499664f3a5038841e
SHA512 9837b6a05688b1474741a7f18b9deaf0e3c903a9dd4575fda84802e6708192e04e684fea0a5035ecd8aa55eca7176351b9c8e534be4a04f9f6abab86069ff235

memory/4744-52-0x0000000000A90000-0x0000000000B08000-memory.dmp

memory/4744-54-0x0000000005340000-0x0000000005386000-memory.dmp

memory/4744-55-0x0000000075160000-0x0000000075910000-memory.dmp

memory/4744-56-0x0000000005390000-0x00000000053C4000-memory.dmp

memory/1872-57-0x00007FFB967F0000-0x00007FFB969E5000-memory.dmp

memory/4744-58-0x0000000005450000-0x0000000005460000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Csb.exe

MD5 b9e4ee9c00304a3fe3f56034dbd77ab5
SHA1 d66e3e810f1ed8d11bd10b646e51a9ea27c076e3
SHA256 29ac9f6c347c8afe3e35f64eebe00e6e2e1a10cef12649d4207a8723cf32218f
SHA512 de2ba8bfbfe9fd28724638bcfbb9111e98c0039eae1bed32cad609aafccbda4dce0ac13f73df18efbf193e788946419d0043f8ba5cc196814a7e370150b6a587

C:\Users\Admin\AppData\Local\Microsoft\Csb.exe

MD5 b9e4ee9c00304a3fe3f56034dbd77ab5
SHA1 d66e3e810f1ed8d11bd10b646e51a9ea27c076e3
SHA256 29ac9f6c347c8afe3e35f64eebe00e6e2e1a10cef12649d4207a8723cf32218f
SHA512 de2ba8bfbfe9fd28724638bcfbb9111e98c0039eae1bed32cad609aafccbda4dce0ac13f73df18efbf193e788946419d0043f8ba5cc196814a7e370150b6a587

memory/3408-61-0x0000000000220000-0x0000000000296000-memory.dmp

memory/3408-63-0x0000000004B30000-0x0000000004B74000-memory.dmp

memory/3408-68-0x0000000004A80000-0x0000000004AB2000-memory.dmp

memory/3408-69-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe

MD5 3eef989524d6cbfc300edb40e13832b1
SHA1 a6978138ef84fd3f190a7d42b1b642e4e29cc8b1
SHA256 c4956ec15632c64ce4fdf60ac74cb02321a70e6b6cd6210499664f3a5038841e
SHA512 9837b6a05688b1474741a7f18b9deaf0e3c903a9dd4575fda84802e6708192e04e684fea0a5035ecd8aa55eca7176351b9c8e534be4a04f9f6abab86069ff235

memory/4524-64-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3408-62-0x0000000075160000-0x0000000075910000-memory.dmp

memory/4744-70-0x0000000075160000-0x0000000075910000-memory.dmp

memory/4524-71-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4524-72-0x0000000000400000-0x0000000000413000-memory.dmp

memory/992-73-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Csb.exe

MD5 b9e4ee9c00304a3fe3f56034dbd77ab5
SHA1 d66e3e810f1ed8d11bd10b646e51a9ea27c076e3
SHA256 29ac9f6c347c8afe3e35f64eebe00e6e2e1a10cef12649d4207a8723cf32218f
SHA512 de2ba8bfbfe9fd28724638bcfbb9111e98c0039eae1bed32cad609aafccbda4dce0ac13f73df18efbf193e788946419d0043f8ba5cc196814a7e370150b6a587

memory/992-76-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe

MD5 3eef989524d6cbfc300edb40e13832b1
SHA1 a6978138ef84fd3f190a7d42b1b642e4e29cc8b1
SHA256 c4956ec15632c64ce4fdf60ac74cb02321a70e6b6cd6210499664f3a5038841e
SHA512 9837b6a05688b1474741a7f18b9deaf0e3c903a9dd4575fda84802e6708192e04e684fea0a5035ecd8aa55eca7176351b9c8e534be4a04f9f6abab86069ff235

memory/3408-77-0x0000000075160000-0x0000000075910000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\(yw3t.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

memory/3912-80-0x0000000075160000-0x0000000075910000-memory.dmp

memory/3912-81-0x00000000058C0000-0x00000000058D0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\(yw3t.exe

MD5 3eef989524d6cbfc300edb40e13832b1
SHA1 a6978138ef84fd3f190a7d42b1b642e4e29cc8b1
SHA256 c4956ec15632c64ce4fdf60ac74cb02321a70e6b6cd6210499664f3a5038841e
SHA512 9837b6a05688b1474741a7f18b9deaf0e3c903a9dd4575fda84802e6708192e04e684fea0a5035ecd8aa55eca7176351b9c8e534be4a04f9f6abab86069ff235

memory/3712-87-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3912-86-0x0000000075160000-0x0000000075910000-memory.dmp

memory/1872-88-0x00007FFB967F0000-0x00007FFB969E5000-memory.dmp

memory/2564-91-0x0000000002E40000-0x0000000002E56000-memory.dmp

memory/992-94-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4524-103-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4524-104-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4524-108-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4524-109-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4524-124-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4524-106-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4524-153-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[1708EF3E-3483].[[email protected]].8base

MD5 7a240adff346e69ce1f0ce5564a1e6b8
SHA1 e8a059831a2f63d9e3d14d60a5a71a6319791fc7
SHA256 80c7a358e922198d30202f5f389ea8844e5bf9b0feb39dcbbc6368bda2f3efdb
SHA512 d07d2c9a0f9d680c368205d944f8fb97a206993ba6c13346cdc04d367a087fe6c9e4ac2f708845f60e571d461a050e9050e57883bc45feb79a9d1c23890633e1

memory/4524-135-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4524-304-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4524-256-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4524-113-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4524-306-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4524-305-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4524-427-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6E94.exe

MD5 3eef989524d6cbfc300edb40e13832b1
SHA1 a6978138ef84fd3f190a7d42b1b642e4e29cc8b1
SHA256 c4956ec15632c64ce4fdf60ac74cb02321a70e6b6cd6210499664f3a5038841e
SHA512 9837b6a05688b1474741a7f18b9deaf0e3c903a9dd4575fda84802e6708192e04e684fea0a5035ecd8aa55eca7176351b9c8e534be4a04f9f6abab86069ff235

C:\Users\Admin\AppData\Local\Temp\6E94.exe

MD5 3eef989524d6cbfc300edb40e13832b1
SHA1 a6978138ef84fd3f190a7d42b1b642e4e29cc8b1
SHA256 c4956ec15632c64ce4fdf60ac74cb02321a70e6b6cd6210499664f3a5038841e
SHA512 9837b6a05688b1474741a7f18b9deaf0e3c903a9dd4575fda84802e6708192e04e684fea0a5035ecd8aa55eca7176351b9c8e534be4a04f9f6abab86069ff235

C:\Users\Admin\AppData\Local\Temp\6E94.exe

MD5 3eef989524d6cbfc300edb40e13832b1
SHA1 a6978138ef84fd3f190a7d42b1b642e4e29cc8b1
SHA256 c4956ec15632c64ce4fdf60ac74cb02321a70e6b6cd6210499664f3a5038841e
SHA512 9837b6a05688b1474741a7f18b9deaf0e3c903a9dd4575fda84802e6708192e04e684fea0a5035ecd8aa55eca7176351b9c8e534be4a04f9f6abab86069ff235

memory/288-4208-0x0000000004D50000-0x0000000004D96000-memory.dmp

memory/288-4207-0x0000000075040000-0x00000000757F0000-memory.dmp

memory/288-4214-0x0000000004D90000-0x0000000004DA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7328.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\7328.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/4620-4253-0x0000000075040000-0x00000000757F0000-memory.dmp

memory/4620-4255-0x0000000000820000-0x000000000089C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6E94.exe

MD5 3eef989524d6cbfc300edb40e13832b1
SHA1 a6978138ef84fd3f190a7d42b1b642e4e29cc8b1
SHA256 c4956ec15632c64ce4fdf60ac74cb02321a70e6b6cd6210499664f3a5038841e
SHA512 9837b6a05688b1474741a7f18b9deaf0e3c903a9dd4575fda84802e6708192e04e684fea0a5035ecd8aa55eca7176351b9c8e534be4a04f9f6abab86069ff235

memory/4620-4272-0x0000000005260000-0x00000000052F2000-memory.dmp

memory/288-4277-0x0000000075040000-0x00000000757F0000-memory.dmp

memory/4620-4281-0x00000000053A0000-0x000000000543C000-memory.dmp

memory/2096-4279-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2356-4353-0x0000000000F40000-0x0000000000FB5000-memory.dmp

memory/2356-4365-0x0000000000ED0000-0x0000000000F3B000-memory.dmp

memory/4620-4368-0x0000000006190000-0x00000000061A0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ob75hbeb.default-release\cookies.sqlite.id[1708EF3E-3483].[[email protected]].8base

MD5 a25076f0cbd58ce009e8c2e96bcc1af6
SHA1 d10db9b8670477eee907ecf78883a34aacd80903
SHA256 2c1f7c27bfbad7cd75797c1ee8bb70c32cca9e75807902b85ec62234300c60cc
SHA512 5ac20e041a79af9c8e9a6bffb2993d4d750c9db8aa7c028009264de9e471a77b2ebcfda9834fec6f6e4bfceb73adce348cdad39c6733bd47d01a36b90790c0fe

memory/4620-4387-0x0000000006120000-0x0000000006162000-memory.dmp

memory/2248-4502-0x0000000000B50000-0x0000000000B57000-memory.dmp

memory/4620-4498-0x00000000064F0000-0x00000000064FA000-memory.dmp

memory/2248-4519-0x0000000000B40000-0x0000000000B4C000-memory.dmp

memory/2248-4537-0x0000000000B40000-0x0000000000B4C000-memory.dmp

memory/2356-4749-0x0000000000ED0000-0x0000000000F3B000-memory.dmp

memory/3352-4868-0x0000000000140000-0x0000000000149000-memory.dmp

memory/3352-4860-0x0000000000150000-0x0000000000154000-memory.dmp

memory/4620-4949-0x0000000075040000-0x00000000757F0000-memory.dmp

memory/4620-4963-0x0000000006190000-0x00000000061A0000-memory.dmp

memory/296-4953-0x00000000005B0000-0x00000000005BB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B561.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\B561.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\B561.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\B561.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\B561.tmp\aa_nts.msg

MD5 3f05819f995b4dafa1b5d55ce8d1f411
SHA1 404449b79a16bfc4f64f2fd55cd73d5d27a85d71
SHA256 7e0bf0cbd06a087500a9c3b50254df3a8a2c2980921ab6a62ab1121941c80fc0
SHA512 34abb7df8b3a68e1649ff0d2762576a4d4e65da548e74b1aa65c2b82c1b89f90d053ecddac67c614ca6084dc5b2cb552949250fb70f49b536f1bcb0057717026

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Csb.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6E94.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000028.db.id[1708EF3E-3483].[[email protected]].8base

MD5 381f7157bfdea1586964318b77f669c7
SHA1 f2ad34cdf06f06f3375b15bd66ec744e2b83558f
SHA256 fba9b51f1867377251958969bb336662b9cbef4d86064bf18cea00dd91dd2719
SHA512 59abd7e3d34c053262515f27694c66b4c311be7102a900df1c719398951611f54499fe00bffd08ada83b08bd1d3e26ac75c9cf55f2fe075037fd108d016bf616

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.dll

MD5 982097d65f6a8a34e1a20adc87ab8cea
SHA1 22f12025e43584daf68c7dfe13c5a2c7b2ef4681
SHA256 6c71eb6ef4a3487cb0c5ac9d0edbc76e765301f15ec297c13828dc0903a9ade0
SHA512 43efa212da302cffef9ba8fb01d63df271c7716f1231aafb220633f6bc6ce0b30cdd4cd197edc0aac82b10c687320fcab5ae57a30c4574d55ea637a3be3f3707

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe

MD5 cfe72ed40a076ae4f4157940ce0c5d44
SHA1 8010f7c746a7ba4864785f798f46ec05caae7ece
SHA256 6868894ab04d08956388a94a81016f03d5b7a7b1646c8a6235057a7e1e45de32
SHA512 f002afa2131d250dd6148d8372ce45f84283b8e1209e91720cee7aff497503d0e566bae3a83cd326701458230ae5c0e200eec617889393dd46ac00ff357ff1b0

C:\Users\Admin\AppData\Local\Temp\A3CD\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe.xml

MD5 108f130067a9df1719c590316a5245f7
SHA1 79bb9a86e7a50c85214cd7e21719f0cb4155f58a
SHA256 c91debd34057ca5c280ca15ac542733930e1c94c7d887448eac6e3385b5a0874
SHA512 d43b3861d5153c7ca54edd078c900d31599fc9f04d6883a449d62c7e86a105a3c5dfb2d232255c41505b210b063caf6325921dc074fcdf93407c9e2c985a5301

C:\Users\Admin\AppData\Local\Temp\A3CD\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe.xml

MD5 94f90fcd2b8f7f1df69224f845d9e9b7
SHA1 a09e3072cc581cf89adaf1aa20aa89b3af7bf987
SHA256 a16113a66b1c36f919b5f7eaa3fb7aa8e0ba9e057823861aabea703cc06a04c0
SHA512 51f4ee06a8d8bf1121083bf4383433160f16c68d1fe4c44e5d0e0529910d27ba8446c7a4bef359b990574d1d61563da30139c6d09ad0ad1a5b5c7748b8da08f3

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Windows\System32\WalletProxy.dll

MD5 d09724c29a8f321f2f9c552de6ef6afa
SHA1 d6ce3d3a973695f4f770e7fb3fcb5e2f3df592a3
SHA256 23cc82878957683184fbd0e3098e9e6858978bf78d7812c6d7470ebdc79d1c5c
SHA512 cc8db1b0c4bbd94dfc8a669cd6accf6fa29dc1034ce03d9dae53d6ce117bb86b432bf040fb53230b612c6e9a325e58acc8ebb600f760a8d9d6a383ce751fd6ed

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Windows\System32\WalletBackgroundServiceProxy.dll

MD5 1097d1e58872f3cf58f78730a697ce4b
SHA1 96db4e4763a957b28dd80ec1e43eb27367869b86
SHA256 83ec0be293b19d00eca4ae51f16621753e1d2b11248786b25a1abaae6230bdef
SHA512 b933eac4eaabacc51069a72b24b649b980aea251b1b87270ff4ffea12de9368d5447cdbe748ac7faf2805548b896c8499f9eceeed2f5efd0c684f94360940351

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Windows\System32\Windows.ApplicationModel.Wallet.dll

MD5 02557c141c9e153c2b7987b79a3a2dd7
SHA1 a054761382ee68608b6a3b62b68138dc205f576b
SHA256 207c587e769e2655669bd3ce1d28a00bcac08f023013735f026f65c0e3baa6f4
SHA512 a37e29c115bcb9956b1f8fd2022f2e3966c1fa2a0efa5c2ee2d14bc5c41bfddae0deea4d481a681d13ec58e9dec41e7565f8b4eb1c10f2c44c03e58bdd2792b3

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe.xml

MD5 108f130067a9df1719c590316a5245f7
SHA1 79bb9a86e7a50c85214cd7e21719f0cb4155f58a
SHA256 c91debd34057ca5c280ca15ac542733930e1c94c7d887448eac6e3385b5a0874
SHA512 d43b3861d5153c7ca54edd078c900d31599fc9f04d6883a449d62c7e86a105a3c5dfb2d232255c41505b210b063caf6325921dc074fcdf93407c9e2c985a5301

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe.xml

MD5 94f90fcd2b8f7f1df69224f845d9e9b7
SHA1 a09e3072cc581cf89adaf1aa20aa89b3af7bf987
SHA256 a16113a66b1c36f919b5f7eaa3fb7aa8e0ba9e057823861aabea703cc06a04c0
SHA512 51f4ee06a8d8bf1121083bf4383433160f16c68d1fe4c44e5d0e0529910d27ba8446c7a4bef359b990574d1d61563da30139c6d09ad0ad1a5b5c7748b8da08f3

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Windows\SysWOW64\WalletBackgroundServiceProxy.dll

MD5 1097d1e58872f3cf58f78730a697ce4b
SHA1 96db4e4763a957b28dd80ec1e43eb27367869b86
SHA256 83ec0be293b19d00eca4ae51f16621753e1d2b11248786b25a1abaae6230bdef
SHA512 b933eac4eaabacc51069a72b24b649b980aea251b1b87270ff4ffea12de9368d5447cdbe748ac7faf2805548b896c8499f9eceeed2f5efd0c684f94360940351

C:\Users\Admin\AppData\Local\Temp\7328.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\B561.tmp\settings3.bin

MD5 4c0eef30e41837269e72adbbee3b6aa2
SHA1 9d3384704dbcebcbf1bfe8040882b84605896fe1
SHA256 aeba2a2c1d3239195875919ceb8ef851ac4ad94c7c0a70ee2f01b9991d3c9a73
SHA512 1d76a9e3a2cc4e718a83546dbe46761a104aa1a22ed0843d0ef7c4f5710519daf39b9b35457e68aa7ebffb7dbb92e2f3acdccc15b5ac753e3c776257693fbe70

C:\Users\Admin\AppData\Local\Temp\B561.tmp\hr3

MD5 57331a278bb6d3f0deaf011eef805c83
SHA1 f657eb0640b1ea672bd31d6db8e08a59a0782936
SHA256 34903c03d0312c58dc57ade36cb1d7fd8c88509082a9e70071b7797d9a07bde5
SHA512 81f09e48c625605dbaee441e3ddc3a72e1e32e4f8db4baa6f3d591e88f3c59818d40eeb10d08b9e04e585f515f376411cfe33e9cbffff95b95577f1c4ae2b41b

C:\Users\Admin\AppData\Local\Temp\B561.tmp\aa_nts.log

MD5 711ed5ee4a5e1f33358414459f48d208
SHA1 b19e4edd6699fa70f1dcad9e31e46726baf1dd98
SHA256 6c0bb90e3bd7fe0be60b80e408c1f91ed8514a4ca59e0d08c019f29446957bde
SHA512 8ac15170b3b3f47faf27ca8c862689f6c5d47c41f8ec39c700e924af8b375fc864a26924816aa367189fd5c77e1b504ce097d77bd0b92528672a5bd5b633c1e7

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Windows\SysWOW64\Windows.ApplicationModel.Wallet.dll

MD5 02557c141c9e153c2b7987b79a3a2dd7
SHA1 a054761382ee68608b6a3b62b68138dc205f576b
SHA256 207c587e769e2655669bd3ce1d28a00bcac08f023013735f026f65c0e3baa6f4
SHA512 a37e29c115bcb9956b1f8fd2022f2e3966c1fa2a0efa5c2ee2d14bc5c41bfddae0deea4d481a681d13ec58e9dec41e7565f8b4eb1c10f2c44c03e58bdd2792b3

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Windows\SysWOW64\WalletProxy.dll

MD5 d09724c29a8f321f2f9c552de6ef6afa
SHA1 d6ce3d3a973695f4f770e7fb3fcb5e2f3df592a3
SHA256 23cc82878957683184fbd0e3098e9e6858978bf78d7812c6d7470ebdc79d1c5c
SHA512 cc8db1b0c4bbd94dfc8a669cd6accf6fa29dc1034ce03d9dae53d6ce117bb86b432bf040fb53230b612c6e9a325e58acc8ebb600f760a8d9d6a383ce751fd6ed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

MD5 60fe01df86be2e5331b0cdbe86165686
SHA1 2a79f9713c3f192862ff80508062e64e8e0b29bd
SHA256 c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8
SHA512 ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5037AC1E573F140500110A0B67548B5E

MD5 3f07db8019ca8ab665d6f1be6ed7911a
SHA1 286f3c3ed5f54a2b040ea6be69733053ca22c003
SHA256 2f1802bb721118d76dd1838de9af80fa12bd70259b2a0abe9b2cc3fad2c96145
SHA512 106dbf9c2c92d0cd4280e0464032ab93629a6e97b7fd6af24a592015107b89274810f6aeb136c9068bb6e60108f589066d1b2b19134f78c71a3f56d374eb87a2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

MD5 f26957b272a618996c87c734dfe55571
SHA1 7a80f373e5d6e79a14b3a45a773159e0d6383c2c
SHA256 b1b29bf0f910c9a2c2fe6ce49bcf1bb6111d1017bbf43731f6bd534f3bcf6d77
SHA512 0ee12329ca6e93fcacd399e31e66ab2eda8009c10b1569ae8f1b35db6da1bb019cf22e6ecac79b7a616310f5d0571c4b37e6abced8a0a85c32a598f5ee1c78d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5037AC1E573F140500110A0B67548B5E

MD5 46100fd54167d95d77018c10f8b19b01
SHA1 58a98e55a451abd338932f350efa223b488b5fd8
SHA256 ead6c4d76ba4f46538ab0a735c772fb60dcd3bf6ffd92d214e43b96eaf938486
SHA512 4710a2d5bfb37ae09f3aab042961bf0bbda55fadd1e369a3d03d0173c28cf03465ca8245fef1354ca0a6a26abe15e3b978bc93e0b8b1d41b684cd0b404266a59

C:\Users\Admin\AppData\Roaming\arwahcd

MD5 f83e21e1dd3cf4a70c357dbaef7d4cd8
SHA1 4d8bdd84b7b474108e6793338e497efa8d36c89f
SHA256 2989e367b7aa355b05a2b89fd62ede8e3f129a85d3d391bddbd519a6331c8c8e
SHA512 97738994fd6e77767f4a69e317c62e3d4f46b7ffd8f931864d93ef4bfc1c7734c4c2a1ea474f821fdd4145f0917fbfde39403faf0585ec526daa8a4c5c0d0931

C:\Users\Admin\AppData\Roaming\fbbhaiv

MD5 b9e4ee9c00304a3fe3f56034dbd77ab5
SHA1 d66e3e810f1ed8d11bd10b646e51a9ea27c076e3
SHA256 29ac9f6c347c8afe3e35f64eebe00e6e2e1a10cef12649d4207a8723cf32218f
SHA512 de2ba8bfbfe9fd28724638bcfbb9111e98c0039eae1bed32cad609aafccbda4dce0ac13f73df18efbf193e788946419d0043f8ba5cc196814a7e370150b6a587

C:\info.hta

MD5 9b9bd361f4e35f3fb12efb847d394b1c
SHA1 c64a7b722d1c6c2dc325cb3f7266a04ce74380a4
SHA256 c2524e3d1ad09fba2f35459de1d24edbe9faea9f0ef8a0491dc61868cbec9cf5
SHA512 5bdc07afdb72e6c27f81011e0a3b654512a6f84a1a23fccaf79a90b6157f3a89a018c954f18fd51e863fe853d07925d871e15fcfc3ace35960fa2da1f00452b8

F:\info.hta

MD5 9b9bd361f4e35f3fb12efb847d394b1c
SHA1 c64a7b722d1c6c2dc325cb3f7266a04ce74380a4
SHA256 c2524e3d1ad09fba2f35459de1d24edbe9faea9f0ef8a0491dc61868cbec9cf5
SHA512 5bdc07afdb72e6c27f81011e0a3b654512a6f84a1a23fccaf79a90b6157f3a89a018c954f18fd51e863fe853d07925d871e15fcfc3ace35960fa2da1f00452b8

C:\Users\Admin\Desktop\info.hta

MD5 9b9bd361f4e35f3fb12efb847d394b1c
SHA1 c64a7b722d1c6c2dc325cb3f7266a04ce74380a4
SHA256 c2524e3d1ad09fba2f35459de1d24edbe9faea9f0ef8a0491dc61868cbec9cf5
SHA512 5bdc07afdb72e6c27f81011e0a3b654512a6f84a1a23fccaf79a90b6157f3a89a018c954f18fd51e863fe853d07925d871e15fcfc3ace35960fa2da1f00452b8

C:\info.hta

MD5 9b9bd361f4e35f3fb12efb847d394b1c
SHA1 c64a7b722d1c6c2dc325cb3f7266a04ce74380a4
SHA256 c2524e3d1ad09fba2f35459de1d24edbe9faea9f0ef8a0491dc61868cbec9cf5
SHA512 5bdc07afdb72e6c27f81011e0a3b654512a6f84a1a23fccaf79a90b6157f3a89a018c954f18fd51e863fe853d07925d871e15fcfc3ace35960fa2da1f00452b8

C:\users\public\desktop\info.hta

MD5 9b9bd361f4e35f3fb12efb847d394b1c
SHA1 c64a7b722d1c6c2dc325cb3f7266a04ce74380a4
SHA256 c2524e3d1ad09fba2f35459de1d24edbe9faea9f0ef8a0491dc61868cbec9cf5
SHA512 5bdc07afdb72e6c27f81011e0a3b654512a6f84a1a23fccaf79a90b6157f3a89a018c954f18fd51e863fe853d07925d871e15fcfc3ace35960fa2da1f00452b8

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg.id[1708EF3E-3483].[[email protected]].8base

MD5 a5e3a8048817380f8fd5128112053940
SHA1 8d3d8dc7d7be9c6cc024f89fdc0a342151154219
SHA256 cdcc819ce6e3365a50d8dd108378584cd90818d2ac59f7676c3b83d963d34d94
SHA512 96f2c56d5f3888452cb93abd900623f3abcbb6df598fbd22dd74efdfca3ae7384737cfad3f95da709abf6920aa830b5750d7918b151a7156e85d83494645fe01

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.dll.id[1708EF3E-3483].[[email protected]].8base

MD5 b0049c780858e9afa0a147435e9d9091
SHA1 25a08e8715072444c877340bf8478116e0899118
SHA256 97c39afb57ad6e454cd5aa026a456b3be8137cd43f3a86b4d2638769104ca571
SHA512 6d00326bc711ce76070bc4e716ecdb3e8950880f095bebbbfe793c87dbb71f2ff621df54284290d81e718c5677e09437ecae2d33c6803a2825f7533a6ab3f0b4

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe.id[1708EF3E-3483].[[email protected]].8base

MD5 37bbce91d17fbb569c4df4dd41aeac19
SHA1 5048c39da6a1634fee620b2854d349f7e0dca2d7
SHA256 9e8a813b841cd5f84d5ee0f1dc5510f490aa64fc5ed0aa6281f61d1e218450c8
SHA512 eade4b28eb290304a9a27cb92e1a8a8d6dc55e3a4ab729467c15740dd89688c8c6aa6e81f18c03a0d48fd874fceee5b09c646cf84efa4764108aa68f102d1292

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Windows\System32\Windows.ApplicationModel.Wallet.dll.id[1708EF3E-3483].[[email protected]].8base

MD5 ca0f03f32b605a065aa698ba583818a8
SHA1 15d9764156cc391087a243074eddc7a7762860f2
SHA256 c88995eeceaf4c4a546dc0bf6a4be309620bf871e7294752295bf0cfd0708a90
SHA512 3e3ce8ec2b08ca77778630d93bf4d6534f19b02dcb2547b439c46bd0c7b56dc49832de6f719f2849dd94ee963b4dc8b24efa10b07205dfb3104127ba872c0758

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Windows\System32\WalletProxy.dll.id[1708EF3E-3483].[[email protected]].8base

MD5 19064764e8011d2af494b913bedb029e
SHA1 0b1030c93adfcd706352c67f6adad4ae2d67dbda
SHA256 40669f11875a2141de846eb39ddcbad99c5918d0f0bd53bdc328b9efc99876da
SHA512 d961bbd2e2a8452df1901a1630b953638ed725ce8fc341a81808a08a9f5dc10539bbd32f8dfbf7e0cad4ec97e9d44c1da7028cfba04b7c72e0bbc3d3fe5094c8

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Windows\System32\WalletBackgroundServiceProxy.dll.id[1708EF3E-3483].[[email protected]].8base

MD5 577be4892a9303536268b8b0ea89e6ab
SHA1 cfe6098630fddb7c61108e4083bf8416f53b11d3
SHA256 509a08a5d7831303f56508df28f5686046e727e12b9710c171b70043b4d5230d
SHA512 9c24e31aafb8b24fa1288c6d49803658f81f4ce2b75cfc0967001e6a7c03c4f8d013f9f7ef4003eb341c4e382b27d4eec21c6a03973ac5fb0aec04c014ff14da

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe.xml.id[1708EF3E-3483].[[email protected]].8base

MD5 0c92870b5a7733b3b2dd27a7e7599262
SHA1 621ee8dae972c2d9773db455ff23ae69d7548cef
SHA256 5f6468cd22979c594305bc99306f60b2121ccbecdcc7e5f960a782b345ba109f
SHA512 28b90b29329131baa2ecd63238a6d59546a5c09fb43601cfb964710942ea51305d26bd999196cac9ba35d2754b64e14030e198fcf1723afac7285c316d567aad

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe.xml.id[1708EF3E-3483].[[email protected]].8base

MD5 ff3b984b6ceb9a3ca0737c4f4168a746
SHA1 c944c2af5855ab17f7e5812cd6748bba0fdf2017
SHA256 51b6d50fbfc95666112fdcf4e288a2c6ed657974f63c5b5c03bdaed885a43a4e
SHA512 efd4ac89cda3d1f239f77183aa49171699d540bf8593b38ace368d25022ab51489c1941492c160dd2cc27d403d8b64eb597406cb188ee65f066b598e42257049

C:\Users\Admin\AppData\Local\Temp\A3CD\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe.xml.id[1708EF3E-3483].[[email protected]].8base

MD5 f22f7617b802ad1c5593527a8b93ec73
SHA1 1e4d0ff42223d740e998c7b090cd425d6c1b9438
SHA256 084faa7d4d67edc118c5d91302d7feeec71be7af2e6d43b7fbd58cacd60de6b0
SHA512 97126679bbd44bf1f6c60c76af4bb9132bd7d4a8f30032a89d120654d2da7d951472cc4f9cddeec1f373917a372edbfe41ec25e911913c2663e3e6eeccd0b28e

C:\Users\Admin\AppData\Local\Temp\A3CD\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe.xml.id[1708EF3E-3483].[[email protected]].8base

MD5 9bad9087c1b2e0dee5ecc342011116d1
SHA1 31f22f24f2ede539df6fb002013529ac495dabd9
SHA256 1f75c140b7d84387f9d50e213eb1dd69fa7f8eb3a70045ad5516296f56408b24
SHA512 514bcd1fb347befef15f4f7598485e84bd2065d5000299d3a750a7e1c91f5494f3d196a0e4dffb04e86ec26e7ee4663b9284c974481de4598229bf4d581ce2bd

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Windows\SysWOW64\WalletProxy.dll.id[1708EF3E-3483].[[email protected]].8base

MD5 d819f0d6eeb81f7f6132549efe0896ab
SHA1 35d3e035ca9693ec4337bec5261e2bbe65b702ef
SHA256 be966461466ad8a5bcd17a5c6d1822134f00451bd7ae872cc4e7b76d03b42807
SHA512 c3155ba4d45a6c1ef214bcd9b4096f69588d40a153b63939effe7138f20a68f69d33286d291c2cfd538b6f40db6a6af5d69d849a5ab93d4c6a53b3c748fac7cb

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Windows\SysWOW64\WalletBackgroundServiceProxy.dll.id[1708EF3E-3483].[[email protected]].8base

MD5 acb3a6af43c2c266892e7603ed34362c
SHA1 9288f965f695651686b39bfcbff4cd3c1419e43d
SHA256 d70f52dc192c6c5cfbbcc960f82f8b6e46c4686066925372069c4328bca12f9f
SHA512 81305abd4423ceeca129751095c6a9920959ee3c87febe11f5c0dc7c82aa0e15aa2961eb8ca04cf9ef23f6d50f3090f3177d2999f3dced2d9191cf7cea539306

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Windows\SysWOW64\Windows.ApplicationModel.Wallet.dll.id[1708EF3E-3483].[[email protected]].8base

MD5 10e9de8ff76f5e8b56a47552fd178557
SHA1 d256a180c20ec9eee5e32c4f03139a84731ec998
SHA256 474c80c3381e5cf4deaafc8fcabc767eb2282ecfc50539d237fe2d91cbfafa85
SHA512 98c6e1b41fb0b4e9cf2b199bcff89dfa50118a5d879f632dfc2390168985d1dad2aa731b6e55c55f75082b569e3f10a51bf55a7bd5810f529a4604e96fb29209

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Windows\WinSxS\wow64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_69993b7d6814452d\WalletProxy.dll

MD5 d09724c29a8f321f2f9c552de6ef6afa
SHA1 d6ce3d3a973695f4f770e7fb3fcb5e2f3df592a3
SHA256 23cc82878957683184fbd0e3098e9e6858978bf78d7812c6d7470ebdc79d1c5c
SHA512 cc8db1b0c4bbd94dfc8a669cd6accf6fa29dc1034ce03d9dae53d6ce117bb86b432bf040fb53230b612c6e9a325e58acc8ebb600f760a8d9d6a383ce751fd6ed

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Windows\WinSxS\wow64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_046b779f2003c415\WalletBackgroundServiceProxy.dll

MD5 1097d1e58872f3cf58f78730a697ce4b
SHA1 96db4e4763a957b28dd80ec1e43eb27367869b86
SHA256 83ec0be293b19d00eca4ae51f16621753e1d2b11248786b25a1abaae6230bdef
SHA512 b933eac4eaabacc51069a72b24b649b980aea251b1b87270ff4ffea12de9368d5447cdbe748ac7faf2805548b896c8499f9eceeed2f5efd0c684f94360940351

C:\Users\Admin\AppData\Local\Temp\A3CD\C\Windows\WinSxS\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8\Windows.ApplicationModel.Wallet.dll

MD5 02557c141c9e153c2b7987b79a3a2dd7
SHA1 a054761382ee68608b6a3b62b68138dc205f576b
SHA256 207c587e769e2655669bd3ce1d28a00bcac08f023013735f026f65c0e3baa6f4
SHA512 a37e29c115bcb9956b1f8fd2022f2e3966c1fa2a0efa5c2ee2d14bc5c41bfddae0deea4d481a681d13ec58e9dec41e7565f8b4eb1c10f2c44c03e58bdd2792b3

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-28 19:28

Reported

2023-09-28 19:30

Platform

win7-20230831-en

Max time kernel

121s

Max time network

124s

Command Line

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3020 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe
PID 3020 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe

"C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636_JC.exe"

Network

N/A

Files

memory/3020-6-0x00000000741D0000-0x00000000748BE000-memory.dmp

memory/3020-5-0x00000000046D0000-0x000000000471C000-memory.dmp

memory/3020-4-0x0000000002210000-0x0000000002278000-memory.dmp

memory/3020-3-0x00000000047A0000-0x00000000047E0000-memory.dmp

memory/3020-2-0x0000000004650000-0x00000000046C8000-memory.dmp

memory/3020-1-0x00000000741D0000-0x00000000748BE000-memory.dmp

memory/3020-0-0x0000000000370000-0x0000000000556000-memory.dmp