Malware Analysis Report

2024-10-16 05:10

Sample ID 231001-mgcefaaa7t
Target 0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b
SHA256 0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b
Tags
ammyyadmin phobos smokeloader backdoor collection evasion persistence ransomware rat trojan flawedammyy gurcu stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b

Threat Level: Known bad

The file 0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b was found to be: Known bad.

Malicious Activity Summary

ammyyadmin phobos smokeloader backdoor collection evasion persistence ransomware rat trojan flawedammyy gurcu stealer

Detect Gurcu Stealer V3 payload

FlawedAmmyy RAT

Gurcu, WhiteSnake

SmokeLoader

AmmyyAdmin payload

Ammyy Admin

Phobos

Renames multiple (54) files with added filename extension

Deletes shadow copies

Modifies boot configuration data using bcdedit

Downloads MZ/PE file

Deletes backup catalog

Modifies Windows Firewall

Drops startup file

Deletes itself

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook profiles

Adds Run key to start application

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

outlook_win_path

Suspicious behavior: EnumeratesProcesses

Uses Volume Shadow Copy service COM API

Uses Task Scheduler COM API

Suspicious behavior: MapViewOfSection

outlook_office_path

Interacts with shadow copies

Checks SCSI registry key(s)

Suspicious behavior: GetForegroundWindowSpam

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-01 10:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-01 10:25

Reported

2023-10-01 10:28

Platform

win7-20230831-en

Max time kernel

150s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe"

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Phobos

ransomware phobos

SmokeLoader

trojan backdoor smokeloader

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\A737.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\A737.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\A737 = "C:\\Users\\Admin\\AppData\\Local\\A737.exe" C:\Users\Admin\AppData\Local\Temp\A737.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows\CurrentVersion\Run\A737 = "C:\\Users\\Admin\\AppData\\Local\\A737.exe" C:\Users\Admin\AppData\Local\Temp\A737.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\A737.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\A737.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AA54.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\A737.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1656 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe
PID 1656 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe
PID 1656 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe
PID 1656 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe
PID 1656 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe
PID 1656 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe
PID 1656 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe
PID 1192 wrote to memory of 2648 N/A N/A C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 1192 wrote to memory of 2648 N/A N/A C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 1192 wrote to memory of 2648 N/A N/A C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 1192 wrote to memory of 2648 N/A N/A C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2648 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2648 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2648 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2648 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2648 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2648 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2648 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 1192 wrote to memory of 2804 N/A N/A C:\Users\Admin\AppData\Local\Temp\AA54.exe
PID 1192 wrote to memory of 2804 N/A N/A C:\Users\Admin\AppData\Local\Temp\AA54.exe
PID 1192 wrote to memory of 2804 N/A N/A C:\Users\Admin\AppData\Local\Temp\AA54.exe
PID 1192 wrote to memory of 2804 N/A N/A C:\Users\Admin\AppData\Local\Temp\AA54.exe
PID 2648 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2648 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2648 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2648 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2976 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2976 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2976 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2976 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2976 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2976 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2976 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2976 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2976 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2976 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 2976 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Users\Admin\AppData\Local\Temp\A737.exe
PID 1192 wrote to memory of 2848 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 1192 wrote to memory of 2848 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 1192 wrote to memory of 2848 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 1192 wrote to memory of 2848 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 1192 wrote to memory of 2848 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 1192 wrote to memory of 2332 N/A N/A C:\Windows\explorer.exe
PID 1192 wrote to memory of 2332 N/A N/A C:\Windows\explorer.exe
PID 1192 wrote to memory of 2332 N/A N/A C:\Windows\explorer.exe
PID 1192 wrote to memory of 2332 N/A N/A C:\Windows\explorer.exe
PID 2612 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Windows\system32\cmd.exe
PID 2612 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Windows\system32\cmd.exe
PID 2612 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Windows\system32\cmd.exe
PID 2612 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Windows\system32\cmd.exe
PID 2612 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Windows\system32\cmd.exe
PID 2612 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Windows\system32\cmd.exe
PID 2612 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Windows\system32\cmd.exe
PID 2612 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\A737.exe C:\Windows\system32\cmd.exe

Uses Task Scheduler COM API

persistence

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe

"C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe"

C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe

C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe

C:\Users\Admin\AppData\Local\Temp\A737.exe

C:\Users\Admin\AppData\Local\Temp\A737.exe

C:\Users\Admin\AppData\Local\Temp\A737.exe

C:\Users\Admin\AppData\Local\Temp\A737.exe

C:\Users\Admin\AppData\Local\Temp\AA54.exe

C:\Users\Admin\AppData\Local\Temp\AA54.exe

C:\Users\Admin\AppData\Local\Temp\A737.exe

"C:\Users\Admin\AppData\Local\Temp\A737.exe"

C:\Users\Admin\AppData\Local\Temp\A737.exe

C:\Users\Admin\AppData\Local\Temp\A737.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\AA54.exe

"C:\Users\Admin\AppData\Local\Temp\AA54.exe"

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\5BB.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\5BB.tmp\svchost.exe -debug

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 moknex158.xyz udp
DE 212.87.212.222:80 moknex158.xyz tcp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 apps.identrust.com udp
US 2.18.121.68:80 apps.identrust.com tcp
US 8.8.8.8:53 cdn1.frocdn.ch udp
NL 204.10.194.180:443 cdn1.frocdn.ch tcp
NL 204.10.194.180:443 cdn1.frocdn.ch tcp
NL 204.10.194.180:443 cdn1.frocdn.ch tcp
NL 204.10.194.180:443 cdn1.frocdn.ch tcp
NL 204.10.194.180:443 cdn1.frocdn.ch tcp
NL 204.10.194.180:443 cdn1.frocdn.ch tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp

Files

memory/1656-0-0x00000000001D0000-0x000000000024C000-memory.dmp

memory/1656-1-0x0000000073EA0000-0x000000007458E000-memory.dmp

memory/1656-2-0x0000000000620000-0x0000000000660000-memory.dmp

memory/1656-3-0x00000000005E0000-0x0000000000622000-memory.dmp

memory/1656-4-0x00000000008B0000-0x00000000008F4000-memory.dmp

memory/1656-5-0x00000000004B0000-0x00000000004E2000-memory.dmp

memory/1656-6-0x0000000002170000-0x00000000021BC000-memory.dmp

memory/2064-7-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2064-8-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2064-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2064-11-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2064-12-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1656-13-0x0000000073EA0000-0x000000007458E000-memory.dmp

memory/2064-15-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1192-14-0x0000000002A70000-0x0000000002A86000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A737.exe

MD5 f9899aee0d49cb3458d02a5bf35934c7
SHA1 242a0a0f176ac81529062d42338d0ec0420c5e59
SHA256 4fd3f6a16bccb7c9d4631241b6f8ebe58515fa2c593e4c938939492615869432
SHA512 e92067f9c513daca24485d87db5e2485a9e980c7cd16cf5c612a653ada34d2b301504fe9417b79137ca20aeac6c1ede6145e46bd27d5772488dde7d522b4294f

C:\Users\Admin\AppData\Local\Temp\A737.exe

MD5 f9899aee0d49cb3458d02a5bf35934c7
SHA1 242a0a0f176ac81529062d42338d0ec0420c5e59
SHA256 4fd3f6a16bccb7c9d4631241b6f8ebe58515fa2c593e4c938939492615869432
SHA512 e92067f9c513daca24485d87db5e2485a9e980c7cd16cf5c612a653ada34d2b301504fe9417b79137ca20aeac6c1ede6145e46bd27d5772488dde7d522b4294f

memory/2648-29-0x0000000000D90000-0x0000000000E10000-memory.dmp

memory/2648-30-0x00000000737B0000-0x0000000073E9E000-memory.dmp

memory/2648-32-0x0000000000380000-0x00000000003C0000-memory.dmp

memory/2648-33-0x0000000000630000-0x0000000000676000-memory.dmp

memory/2648-31-0x00000000005E0000-0x0000000000626000-memory.dmp

memory/2648-34-0x0000000000A50000-0x0000000000A84000-memory.dmp

\Users\Admin\AppData\Local\Temp\A737.exe

MD5 f9899aee0d49cb3458d02a5bf35934c7
SHA1 242a0a0f176ac81529062d42338d0ec0420c5e59
SHA256 4fd3f6a16bccb7c9d4631241b6f8ebe58515fa2c593e4c938939492615869432
SHA512 e92067f9c513daca24485d87db5e2485a9e980c7cd16cf5c612a653ada34d2b301504fe9417b79137ca20aeac6c1ede6145e46bd27d5772488dde7d522b4294f

memory/2612-36-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2612-38-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2612-40-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2612-42-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AA54.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\AA54.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/2804-51-0x00000000737B0000-0x0000000073E9E000-memory.dmp

memory/2804-50-0x0000000000F60000-0x0000000000FDC000-memory.dmp

memory/2612-49-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2612-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2612-53-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2612-57-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2648-59-0x00000000737B0000-0x0000000073E9E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A737.exe

MD5 f9899aee0d49cb3458d02a5bf35934c7
SHA1 242a0a0f176ac81529062d42338d0ec0420c5e59
SHA256 4fd3f6a16bccb7c9d4631241b6f8ebe58515fa2c593e4c938939492615869432
SHA512 e92067f9c513daca24485d87db5e2485a9e980c7cd16cf5c612a653ada34d2b301504fe9417b79137ca20aeac6c1ede6145e46bd27d5772488dde7d522b4294f

memory/2612-61-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2612-62-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2804-63-0x0000000004C80000-0x0000000004CC0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A737.exe

MD5 f9899aee0d49cb3458d02a5bf35934c7
SHA1 242a0a0f176ac81529062d42338d0ec0420c5e59
SHA256 4fd3f6a16bccb7c9d4631241b6f8ebe58515fa2c593e4c938939492615869432
SHA512 e92067f9c513daca24485d87db5e2485a9e980c7cd16cf5c612a653ada34d2b301504fe9417b79137ca20aeac6c1ede6145e46bd27d5772488dde7d522b4294f

memory/2976-66-0x00000000737B0000-0x0000000073E9E000-memory.dmp

memory/2976-65-0x0000000000450000-0x0000000000496000-memory.dmp

memory/2976-67-0x0000000004840000-0x0000000004880000-memory.dmp

\Users\Admin\AppData\Local\Temp\A737.exe

MD5 f9899aee0d49cb3458d02a5bf35934c7
SHA1 242a0a0f176ac81529062d42338d0ec0420c5e59
SHA256 4fd3f6a16bccb7c9d4631241b6f8ebe58515fa2c593e4c938939492615869432
SHA512 e92067f9c513daca24485d87db5e2485a9e980c7cd16cf5c612a653ada34d2b301504fe9417b79137ca20aeac6c1ede6145e46bd27d5772488dde7d522b4294f

memory/2804-69-0x0000000000610000-0x0000000000652000-memory.dmp

memory/2472-82-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A737.exe

MD5 f9899aee0d49cb3458d02a5bf35934c7
SHA1 242a0a0f176ac81529062d42338d0ec0420c5e59
SHA256 4fd3f6a16bccb7c9d4631241b6f8ebe58515fa2c593e4c938939492615869432
SHA512 e92067f9c513daca24485d87db5e2485a9e980c7cd16cf5c612a653ada34d2b301504fe9417b79137ca20aeac6c1ede6145e46bd27d5772488dde7d522b4294f

memory/2976-87-0x00000000737B0000-0x0000000073E9E000-memory.dmp

memory/2472-89-0x0000000000401000-0x000000000040A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabB704.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\TarB793.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 79268d643643afeccbb053b2ae591272
SHA1 888c28e2f0cb0d70832b6f1ea4df7197a76863d6
SHA256 b631ed92eeda00d613eed841a7155d7a1bda3c05de6460999ff765976939d4b5
SHA512 f22ba8e3fcf44acc37080627ff4773b47fd894aa667803d79a1df47ba96c499b4a4ed8d6e8304881ce1ff56149396d28d6a5bcdfaa57d9bceadd4f720f4d13fc

memory/2848-152-0x00000000001C0000-0x0000000000235000-memory.dmp

memory/2848-154-0x0000000000150000-0x00000000001BB000-memory.dmp

memory/2848-167-0x0000000000150000-0x00000000001BB000-memory.dmp

memory/2332-168-0x00000000000E0000-0x00000000000EC000-memory.dmp

memory/2804-170-0x00000000737B0000-0x0000000073E9E000-memory.dmp

memory/2804-169-0x0000000000AF0000-0x0000000000B0A000-memory.dmp

memory/2332-171-0x0000000000150000-0x00000000001BB000-memory.dmp

memory/2332-172-0x00000000000E0000-0x00000000000EC000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A737.exe

MD5 f9899aee0d49cb3458d02a5bf35934c7
SHA1 242a0a0f176ac81529062d42338d0ec0420c5e59
SHA256 4fd3f6a16bccb7c9d4631241b6f8ebe58515fa2c593e4c938939492615869432
SHA512 e92067f9c513daca24485d87db5e2485a9e980c7cd16cf5c612a653ada34d2b301504fe9417b79137ca20aeac6c1ede6145e46bd27d5772488dde7d522b4294f

memory/2612-182-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2612-184-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2612-185-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2612-186-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2612-187-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2612-188-0x0000000000400000-0x0000000000413000-memory.dmp

memory/608-190-0x0000000000080000-0x0000000000089000-memory.dmp

memory/608-191-0x0000000000090000-0x0000000000094000-memory.dmp

memory/2804-189-0x00000000008F0000-0x00000000008F6000-memory.dmp

memory/608-192-0x0000000000080000-0x0000000000089000-memory.dmp

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab.id[7E394F87-3483].[[email protected]].8base

MD5 ce9a6360c5f244130827659ae3110bea
SHA1 24c45902ad0737137229de5a1d7289c56137646b
SHA256 083f97a17e315f28f0432dfe3844544e192ac76cc8d16ace6447daa078253a9c
SHA512 05769a67fe8fd0170e21ff9ad8b62daeeb5fc6d113e4641f6b6506d6881e7f59e954189fd4ca1b6ca9beefa39994dd8ce26cf730bd64d8c7dceb7b3ec6e24163

memory/2444-256-0x0000000000090000-0x000000000009A000-memory.dmp

memory/2444-257-0x0000000000080000-0x000000000008B000-memory.dmp

memory/2708-319-0x0000000000090000-0x0000000000097000-memory.dmp

memory/2708-324-0x0000000000080000-0x000000000008B000-memory.dmp

\Users\Admin\AppData\Local\Temp\AA54.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/2772-451-0x00000000000F0000-0x00000000000F9000-memory.dmp

memory/2772-452-0x00000000000E0000-0x00000000000EF000-memory.dmp

memory/288-465-0x0000000000080000-0x0000000000089000-memory.dmp

memory/288-460-0x00000000000D0000-0x00000000000D5000-memory.dmp

memory/608-484-0x0000000000090000-0x0000000000094000-memory.dmp

memory/2924-493-0x0000000000070000-0x0000000000076000-memory.dmp

memory/2924-494-0x0000000000060000-0x000000000006C000-memory.dmp

memory/2156-525-0x0000000000090000-0x0000000000094000-memory.dmp

memory/2156-534-0x0000000000080000-0x0000000000089000-memory.dmp

memory/2120-585-0x0000000000080000-0x0000000000089000-memory.dmp

memory/2708-583-0x0000000000090000-0x0000000000097000-memory.dmp

memory/2120-586-0x00000000000E0000-0x00000000000E9000-memory.dmp

memory/2772-688-0x00000000000F0000-0x00000000000F9000-memory.dmp

memory/2240-690-0x00000000000E0000-0x00000000000E9000-memory.dmp

memory/2240-699-0x0000000000080000-0x00000000000A7000-memory.dmp

memory/288-728-0x00000000000D0000-0x00000000000D5000-memory.dmp

memory/2404-748-0x0000000000080000-0x00000000000A7000-memory.dmp

memory/2404-755-0x0000000000080000-0x0000000000089000-memory.dmp

memory/2924-840-0x0000000000070000-0x0000000000076000-memory.dmp

memory/1016-841-0x0000000000080000-0x0000000000089000-memory.dmp

memory/1016-842-0x0000000000080000-0x000000000008B000-memory.dmp

memory/2156-867-0x0000000000090000-0x0000000000094000-memory.dmp

memory/3016-922-0x0000000000080000-0x000000000008B000-memory.dmp

\Users\Admin\AppData\Local\Temp\5BB.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\5BB.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\5BB.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

\Users\Admin\AppData\Local\Temp\5BB.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\5BB.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

MD5 d4ae187b4574036c2d76b6df8a8c1a30
SHA1 b06f409fa14bab33cbaf4a37811b8740b624d9e5
SHA256 a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7
SHA512 1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

MD5 8060a9c15d20b3a3ccb5ae2e2b3f7a1f
SHA1 939445cb605ce03b90ffb6bacda1d2e37739d621
SHA256 b1acbedb36712d1e3ee3159c8baa996fa659a5826c30dc3570333dcda9271a7f
SHA512 35ae863b59cf13a9b19d273dd220c6449da8ee54151e27d4bd20452f4d82c2c3ba179466f8891abc4ad6b60423b6a7c71b01c58ea931411878fedaa7460a3019

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 37b733f2e094b6a6a46d047d11da8c1c
SHA1 e366924670cf4205a9e253820e38a9d909db20d5
SHA256 71a61a5910b8000aea592d936a73d43a40e7fc519e836e3bf2f9c0ac0416577b
SHA512 1ee6ddb8bb182ee0f7057a5f25685da8a58e20b0a2303007cfb46b15fc5f39ff29f5fd91ca646982024d526411b4c3249517fa92bada564b0d6bd400330ad9a4

C:\Users\Admin\AppData\Roaming\chvusss

MD5 ac14661934143dad876947699a4fe5b6
SHA1 15f7e440eb3458d1f97e009b00f9963efb6a745a
SHA256 f1b632d96804ec3ee12a72de92ed1cd75f8924f467df217b8ac84babbecd1847
SHA512 b9fa9d1748e1ac9fc1342cf53742544f40a42b39c7c21b012ecd0c8f64962b543a70f2761ae5e7778fb8f2edac74e8f27e12de688db84ffd889abce14083e8d4

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-01 10:25

Reported

2023-10-01 10:28

Platform

win10v2004-20230915-en

Max time kernel

42s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe"

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect Gurcu Stealer V3 payload

Description Indicator Process Target
N/A N/A N/A N/A

FlawedAmmyy RAT

trojan flawedammyy

Gurcu, WhiteSnake

stealer gurcu

Phobos

ransomware phobos

SmokeLoader

trojan backdoor smokeloader

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (54) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\F7BE = "C:\\Users\\Admin\\AppData\\Local\\F7BE.exe" C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\F7BE = "C:\\Users\\Admin\\AppData\\Local\\F7BE.exe" C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3027552071-446050021-1254071215-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3027552071-446050021-1254071215-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\ku.txt.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\jawt.h C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\Content.xml C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\db\bin\setEmbeddedCP.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_hu.jar.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\wsdetect.dll.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\ffjcext.zip C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0 C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages.properties C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_it.properties C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack.dll C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\java.policy.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\jpeg.dll.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\glib-lite.dll C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\README.txt.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ms.txt C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ta.txt C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\stopNetworkServer C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.inject_1.0.0.v20091030.jar.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jsdt.dll C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\lcms.dll.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\7-Zip\7zCon.sfx C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\npt.dll.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_CopyDrop32x32.gif C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd.id[530211B9-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\F8D8.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2BA2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\28E2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4360 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe
PID 4360 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe
PID 4360 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe
PID 4360 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe
PID 4360 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe
PID 4360 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe
PID 4360 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe
PID 4360 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe
PID 4360 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe
PID 3192 wrote to memory of 4780 N/A N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 3192 wrote to memory of 4780 N/A N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 3192 wrote to memory of 4780 N/A N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 3192 wrote to memory of 3772 N/A N/A C:\Users\Admin\AppData\Local\Temp\F8D8.exe
PID 3192 wrote to memory of 3772 N/A N/A C:\Users\Admin\AppData\Local\Temp\F8D8.exe
PID 3192 wrote to memory of 3772 N/A N/A C:\Users\Admin\AppData\Local\Temp\F8D8.exe
PID 4780 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4780 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4780 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4780 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4780 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4780 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4780 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4780 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4780 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4780 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4192 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4192 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4192 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4192 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4192 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4192 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4192 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4192 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4192 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 4192 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Users\Admin\AppData\Local\Temp\F7BE.exe
PID 3772 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\F8D8.exe C:\Users\Admin\AppData\Local\Temp\F8D8.exe
PID 3772 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\F8D8.exe C:\Users\Admin\AppData\Local\Temp\F8D8.exe
PID 3772 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\F8D8.exe C:\Users\Admin\AppData\Local\Temp\F8D8.exe
PID 3772 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\F8D8.exe C:\Users\Admin\AppData\Local\Temp\F8D8.exe
PID 3772 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\F8D8.exe C:\Users\Admin\AppData\Local\Temp\F8D8.exe
PID 3772 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\F8D8.exe C:\Users\Admin\AppData\Local\Temp\F8D8.exe
PID 3772 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\F8D8.exe C:\Users\Admin\AppData\Local\Temp\F8D8.exe
PID 3772 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\F8D8.exe C:\Users\Admin\AppData\Local\Temp\F8D8.exe
PID 3772 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\F8D8.exe C:\Users\Admin\AppData\Local\Temp\F8D8.exe
PID 1100 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Windows\system32\cmd.exe
PID 1100 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Windows\system32\cmd.exe
PID 1100 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Windows\system32\cmd.exe
PID 1100 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\F7BE.exe C:\Windows\system32\cmd.exe
PID 624 wrote to memory of 396 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 624 wrote to memory of 396 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3404 wrote to memory of 2900 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3404 wrote to memory of 2900 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3192 wrote to memory of 1340 N/A N/A C:\Users\Admin\AppData\Local\Temp\28E2.exe
PID 3192 wrote to memory of 1340 N/A N/A C:\Users\Admin\AppData\Local\Temp\28E2.exe
PID 3192 wrote to memory of 1340 N/A N/A C:\Users\Admin\AppData\Local\Temp\28E2.exe
PID 3404 wrote to memory of 3124 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3404 wrote to memory of 3124 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3192 wrote to memory of 4092 N/A N/A C:\Users\Admin\AppData\Local\Temp\2BA2.exe
PID 3192 wrote to memory of 4092 N/A N/A C:\Users\Admin\AppData\Local\Temp\2BA2.exe
PID 3192 wrote to memory of 4092 N/A N/A C:\Users\Admin\AppData\Local\Temp\2BA2.exe
PID 3192 wrote to memory of 4484 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3192 wrote to memory of 4484 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3192 wrote to memory of 4484 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 3192 wrote to memory of 4484 N/A N/A C:\Windows\SysWOW64\explorer.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe

"C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe"

C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe

C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe

C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe

C:\Users\Admin\AppData\Local\Temp\0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b.exe

C:\Users\Admin\AppData\Local\Temp\F7BE.exe

C:\Users\Admin\AppData\Local\Temp\F7BE.exe

C:\Users\Admin\AppData\Local\Temp\F8D8.exe

C:\Users\Admin\AppData\Local\Temp\F8D8.exe

C:\Users\Admin\AppData\Local\Temp\F7BE.exe

C:\Users\Admin\AppData\Local\Temp\F7BE.exe

C:\Users\Admin\AppData\Local\Temp\F7BE.exe

"C:\Users\Admin\AppData\Local\Temp\F7BE.exe"

C:\Users\Admin\AppData\Local\Temp\F7BE.exe

C:\Users\Admin\AppData\Local\Temp\F7BE.exe

C:\Users\Admin\AppData\Local\Temp\F8D8.exe

"C:\Users\Admin\AppData\Local\Temp\F8D8.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Users\Admin\AppData\Local\Temp\28E2.exe

C:\Users\Admin\AppData\Local\Temp\28E2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Update.bat" "

C:\Users\Admin\AppData\Local\Temp\28E2.exe

C:\Users\Admin\AppData\Local\Temp\28E2.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "28E2" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\WindowsSecurity\28E2.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\28E2.exe" &&START "" "C:\Users\Admin\AppData\Local\WindowsSecurity\28E2.exe"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\6A7D.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\6A7D.tmp\svchost.exe -debug

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "28E2" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\WindowsSecurity\28E2.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\WindowsSecurity\28E2.exe

"C:\Users\Admin\AppData\Local\WindowsSecurity\28E2.exe"

C:\Windows\SYSTEM32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6A7D.tmp\aa_nts.dll",run

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Update.bat" "

C:\Users\Admin\AppData\Local\WindowsSecurity\28E2.exe

C:\Users\Admin\AppData\Local\WindowsSecurity\28E2.exe

C:\Users\Admin\AppData\Local\WindowsSecurity\28E2.exe

C:\Users\Admin\AppData\Local\WindowsSecurity\28E2.exe

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profiles

C:\Windows\SysWOW64\findstr.exe

findstr /R /C:"[ ]:[ ]"

C:\Users\Admin\AppData\Local\WindowsSecurity\28E2.exe

C:\Users\Admin\AppData\Local\WindowsSecurity\28E2.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 254.105.26.67.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 moknex158.xyz udp
DE 212.87.212.222:80 moknex158.xyz tcp
US 8.8.8.8:53 120.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 222.212.87.212.in-addr.arpa udp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
US 8.8.8.8:53 cdn1.frocdn.ch udp
NL 204.10.194.180:443 cdn1.frocdn.ch tcp
US 8.8.8.8:53 180.194.10.204.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
NL 204.10.194.180:443 cdn1.frocdn.ch tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.242:443 tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 148.129.42.188.in-addr.arpa udp
US 8.8.8.8:53 242.104.243.136.in-addr.arpa udp
US 8.8.8.8:53 www.ammyy.com udp
DE 136.243.18.118:80 www.ammyy.com tcp
US 8.8.8.8:53 118.18.243.136.in-addr.arpa udp
DE 136.243.18.118:443 www.ammyy.com tcp
US 8.8.8.8:53 147.174.42.23.in-addr.arpa udp
US 8.8.8.8:53 68.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
US 140.82.113.3:443 github.com tcp

Files

memory/4360-0-0x0000000074E30000-0x00000000755E0000-memory.dmp

memory/4360-1-0x0000000000220000-0x000000000029C000-memory.dmp

memory/4360-2-0x0000000004C60000-0x0000000004C70000-memory.dmp

memory/4360-3-0x0000000004BA0000-0x0000000004BE2000-memory.dmp

memory/4360-4-0x0000000004C70000-0x0000000004CB4000-memory.dmp

memory/4360-5-0x0000000004CD0000-0x0000000004D02000-memory.dmp

memory/4360-6-0x0000000004D00000-0x0000000004D4C000-memory.dmp

memory/4360-7-0x0000000005360000-0x0000000005904000-memory.dmp

memory/3060-8-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3060-9-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4360-11-0x0000000074E30000-0x00000000755E0000-memory.dmp

memory/3192-12-0x0000000001550000-0x0000000001566000-memory.dmp

memory/3060-13-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F7BE.exe

MD5 f9899aee0d49cb3458d02a5bf35934c7
SHA1 242a0a0f176ac81529062d42338d0ec0420c5e59
SHA256 4fd3f6a16bccb7c9d4631241b6f8ebe58515fa2c593e4c938939492615869432
SHA512 e92067f9c513daca24485d87db5e2485a9e980c7cd16cf5c612a653ada34d2b301504fe9417b79137ca20aeac6c1ede6145e46bd27d5772488dde7d522b4294f

C:\Users\Admin\AppData\Local\Temp\F7BE.exe

MD5 f9899aee0d49cb3458d02a5bf35934c7
SHA1 242a0a0f176ac81529062d42338d0ec0420c5e59
SHA256 4fd3f6a16bccb7c9d4631241b6f8ebe58515fa2c593e4c938939492615869432
SHA512 e92067f9c513daca24485d87db5e2485a9e980c7cd16cf5c612a653ada34d2b301504fe9417b79137ca20aeac6c1ede6145e46bd27d5772488dde7d522b4294f

memory/4780-26-0x0000000000090000-0x0000000000110000-memory.dmp

memory/4780-28-0x00000000048E0000-0x0000000004926000-memory.dmp

memory/4780-27-0x0000000074E30000-0x00000000755E0000-memory.dmp

memory/4780-30-0x00000000049A0000-0x00000000049E6000-memory.dmp

memory/4780-29-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F8D8.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/4780-35-0x0000000004A00000-0x0000000004A34000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F8D8.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/3772-36-0x0000000074E30000-0x00000000755E0000-memory.dmp

memory/3772-37-0x0000000000250000-0x00000000002CC000-memory.dmp

memory/3772-38-0x0000000004B50000-0x0000000004BE2000-memory.dmp

memory/3772-39-0x0000000004C90000-0x0000000004D2C000-memory.dmp

memory/1100-40-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F7BE.exe

MD5 f9899aee0d49cb3458d02a5bf35934c7
SHA1 242a0a0f176ac81529062d42338d0ec0420c5e59
SHA256 4fd3f6a16bccb7c9d4631241b6f8ebe58515fa2c593e4c938939492615869432
SHA512 e92067f9c513daca24485d87db5e2485a9e980c7cd16cf5c612a653ada34d2b301504fe9417b79137ca20aeac6c1ede6145e46bd27d5772488dde7d522b4294f

memory/1100-46-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4780-45-0x0000000074E30000-0x00000000755E0000-memory.dmp

memory/1100-44-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3772-47-0x0000000005A50000-0x0000000005A60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F7BE.exe

MD5 f9899aee0d49cb3458d02a5bf35934c7
SHA1 242a0a0f176ac81529062d42338d0ec0420c5e59
SHA256 4fd3f6a16bccb7c9d4631241b6f8ebe58515fa2c593e4c938939492615869432
SHA512 e92067f9c513daca24485d87db5e2485a9e980c7cd16cf5c612a653ada34d2b301504fe9417b79137ca20aeac6c1ede6145e46bd27d5772488dde7d522b4294f

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\F7BE.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

memory/3772-50-0x0000000005A60000-0x0000000005AA2000-memory.dmp

memory/4192-51-0x0000000074E30000-0x00000000755E0000-memory.dmp

memory/4192-52-0x0000000004F30000-0x0000000004F40000-memory.dmp

memory/3772-53-0x0000000005DE0000-0x0000000005DEA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F7BE.exe

MD5 f9899aee0d49cb3458d02a5bf35934c7
SHA1 242a0a0f176ac81529062d42338d0ec0420c5e59
SHA256 4fd3f6a16bccb7c9d4631241b6f8ebe58515fa2c593e4c938939492615869432
SHA512 e92067f9c513daca24485d87db5e2485a9e980c7cd16cf5c612a653ada34d2b301504fe9417b79137ca20aeac6c1ede6145e46bd27d5772488dde7d522b4294f

memory/4192-57-0x0000000074E30000-0x00000000755E0000-memory.dmp

memory/1576-59-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3772-60-0x0000000005A50000-0x0000000005A60000-memory.dmp

memory/3772-61-0x0000000006F70000-0x0000000006F8A000-memory.dmp

memory/3772-62-0x0000000005F10000-0x0000000005F16000-memory.dmp

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\F7BE.exe

MD5 f9899aee0d49cb3458d02a5bf35934c7
SHA1 242a0a0f176ac81529062d42338d0ec0420c5e59
SHA256 4fd3f6a16bccb7c9d4631241b6f8ebe58515fa2c593e4c938939492615869432
SHA512 e92067f9c513daca24485d87db5e2485a9e980c7cd16cf5c612a653ada34d2b301504fe9417b79137ca20aeac6c1ede6145e46bd27d5772488dde7d522b4294f

memory/1100-72-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1100-74-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1100-77-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1100-93-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1100-124-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1100-91-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3772-214-0x0000000074E30000-0x00000000755E0000-memory.dmp

memory/1100-224-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1100-240-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1100-266-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[530211B9-3483].[[email protected]].8base

MD5 6b2a3a79c55d6cc84adfad79d2fd79c2
SHA1 f88b9171f72f1ac2de8bc79b87507af54ed2e302
SHA256 5489b5c01d8712b2b9bea3d868890b2d8688bc0c8db0529524e460b34af0615b
SHA512 f9e374fdc291e0b8be9e788dfa3ee7efe6a61b8bfa96c5bd8f8c35e702e20af0be1f49d25a88b3e30b46827de547861c2d8e7eb1805024454b6d137730b26981

memory/1100-213-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1100-79-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1100-76-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1100-299-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1100-285-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1100-317-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1100-334-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3772-379-0x0000000005A50000-0x0000000005A60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\28E2.exe

MD5 86e4447c89dad11996270b6c538f2805
SHA1 a91abbd12885320ca177b5a00792156a30e72a37
SHA256 31a736e30a56614796a42b127e62900f40ca06b877941a1ad240e082b1b96aa9
SHA512 d7426ebabe1ac0d56262fef456ecdca3f991ffc72aaff9fa081bf75e614779cb71669f046b04285d2107ce0ad5ef66ed4312301ce38caa24ecd7cbf7a014609d

C:\Users\Admin\AppData\Local\Temp\28E2.exe

MD5 86e4447c89dad11996270b6c538f2805
SHA1 a91abbd12885320ca177b5a00792156a30e72a37
SHA256 31a736e30a56614796a42b127e62900f40ca06b877941a1ad240e082b1b96aa9
SHA512 d7426ebabe1ac0d56262fef456ecdca3f991ffc72aaff9fa081bf75e614779cb71669f046b04285d2107ce0ad5ef66ed4312301ce38caa24ecd7cbf7a014609d

memory/1340-495-0x0000000074E30000-0x00000000755E0000-memory.dmp

memory/1340-490-0x0000000000450000-0x0000000000D06000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

MD5 31277de974d31978d4013701dee62a4b
SHA1 1e82d394f4c3709215d31fa87172f31d02a198eb
SHA256 eb2a6bff370821d00b58842c80ba0564d699a9d7b82f5af391c5870d239ce671
SHA512 c152c8cb9a4eef5d86dbb85b529eb3bbffa32a0da7912daaffd78cf1c2ca0b95cbc1a7b063df759ebce959e53211a34bcda1ba143c5e30956e3e0db6717c3b29

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

MD5 31277de974d31978d4013701dee62a4b
SHA1 1e82d394f4c3709215d31fa87172f31d02a198eb
SHA256 eb2a6bff370821d00b58842c80ba0564d699a9d7b82f5af391c5870d239ce671
SHA512 c152c8cb9a4eef5d86dbb85b529eb3bbffa32a0da7912daaffd78cf1c2ca0b95cbc1a7b063df759ebce959e53211a34bcda1ba143c5e30956e3e0db6717c3b29

memory/4092-508-0x0000000000060000-0x00000000000A0000-memory.dmp

memory/4092-511-0x0000000074E30000-0x00000000755E0000-memory.dmp

memory/1340-517-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

memory/4092-557-0x0000000002280000-0x0000000002286000-memory.dmp

memory/1340-597-0x0000000007750000-0x0000000007FCC000-memory.dmp

memory/4484-646-0x0000000000470000-0x00000000004E5000-memory.dmp

memory/4484-695-0x0000000000400000-0x000000000046B000-memory.dmp

memory/3944-772-0x00000000004D0000-0x00000000004DC000-memory.dmp

memory/4484-639-0x0000000000400000-0x000000000046B000-memory.dmp

memory/3944-792-0x00000000004E0000-0x00000000004E7000-memory.dmp

memory/3944-847-0x00000000004D0000-0x00000000004DC000-memory.dmp

memory/4476-936-0x0000000000BD0000-0x0000000000BD9000-memory.dmp

memory/4476-964-0x0000000000BE0000-0x0000000000BE4000-memory.dmp

memory/1340-1029-0x0000000007FD0000-0x000000000884C000-memory.dmp

memory/4476-987-0x0000000000BD0000-0x0000000000BD9000-memory.dmp

memory/1340-1157-0x000000000BF70000-0x000000000C7DC000-memory.dmp

memory/4092-1179-0x0000000074E30000-0x00000000755E0000-memory.dmp

memory/4888-1178-0x0000000000BD0000-0x0000000000BDB000-memory.dmp

memory/4888-1180-0x0000000000BD0000-0x0000000000BDB000-memory.dmp

memory/4888-1182-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

memory/1340-1181-0x0000000074E30000-0x00000000755E0000-memory.dmp

memory/1340-1197-0x0000000009850000-0x00000000098B6000-memory.dmp

memory/4484-1318-0x0000000000400000-0x000000000046B000-memory.dmp

memory/3376-1319-0x0000000000B10000-0x0000000000B1B000-memory.dmp

memory/1340-1336-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

memory/1100-1383-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3376-1384-0x0000000000B10000-0x0000000000B1B000-memory.dmp

memory/3376-1381-0x0000000000B20000-0x0000000000B27000-memory.dmp

memory/2132-1472-0x00000000010E0000-0x00000000010E9000-memory.dmp

memory/2132-1471-0x00000000010D0000-0x00000000010DF000-memory.dmp

memory/2132-1478-0x00000000010D0000-0x00000000010DF000-memory.dmp

memory/4092-1730-0x000000000A0D0000-0x000000000AB28000-memory.dmp

memory/5256-1731-0x0000000000B30000-0x0000000000B39000-memory.dmp

memory/5256-1765-0x0000000000B30000-0x0000000000B39000-memory.dmp

memory/5256-1757-0x0000000000B40000-0x0000000000B45000-memory.dmp

memory/1100-1891-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1100-1905-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1784-1990-0x00000000006F0000-0x00000000006FC000-memory.dmp

memory/5700-2150-0x0000000000400000-0x0000000000446000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\28E2.exe

MD5 86e4447c89dad11996270b6c538f2805
SHA1 a91abbd12885320ca177b5a00792156a30e72a37
SHA256 31a736e30a56614796a42b127e62900f40ca06b877941a1ad240e082b1b96aa9
SHA512 d7426ebabe1ac0d56262fef456ecdca3f991ffc72aaff9fa081bf75e614779cb71669f046b04285d2107ce0ad5ef66ed4312301ce38caa24ecd7cbf7a014609d

memory/6072-2174-0x0000000000BD0000-0x0000000000BD9000-memory.dmp

memory/1100-2175-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Update.bat

MD5 73a4d310cdd90000b9cc71223411c40f
SHA1 b068ef9b457bab0ff610047b8f277213c3f26c5b
SHA256 1cc2e10d240a44dca38dd1be915311886213e37e4c1b3006090ed7d33b0b53ff
SHA512 1adea98392da014b1a97259612f647e807cb7f0189bbe6a6689d5d1e83899943ad8647564f71ed870e4671a3cbe98614653170e26b56cce71bb820836bb796e1

memory/700-2194-0x0000000000770000-0x0000000000779000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

MD5 31277de974d31978d4013701dee62a4b
SHA1 1e82d394f4c3709215d31fa87172f31d02a198eb
SHA256 eb2a6bff370821d00b58842c80ba0564d699a9d7b82f5af391c5870d239ce671
SHA512 c152c8cb9a4eef5d86dbb85b529eb3bbffa32a0da7912daaffd78cf1c2ca0b95cbc1a7b063df759ebce959e53211a34bcda1ba143c5e30956e3e0db6717c3b29

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

MD5 31277de974d31978d4013701dee62a4b
SHA1 1e82d394f4c3709215d31fa87172f31d02a198eb
SHA256 eb2a6bff370821d00b58842c80ba0564d699a9d7b82f5af391c5870d239ce671
SHA512 c152c8cb9a4eef5d86dbb85b529eb3bbffa32a0da7912daaffd78cf1c2ca0b95cbc1a7b063df759ebce959e53211a34bcda1ba143c5e30956e3e0db6717c3b29

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

MD5 31277de974d31978d4013701dee62a4b
SHA1 1e82d394f4c3709215d31fa87172f31d02a198eb
SHA256 eb2a6bff370821d00b58842c80ba0564d699a9d7b82f5af391c5870d239ce671
SHA512 c152c8cb9a4eef5d86dbb85b529eb3bbffa32a0da7912daaffd78cf1c2ca0b95cbc1a7b063df759ebce959e53211a34bcda1ba143c5e30956e3e0db6717c3b29

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

MD5 31277de974d31978d4013701dee62a4b
SHA1 1e82d394f4c3709215d31fa87172f31d02a198eb
SHA256 eb2a6bff370821d00b58842c80ba0564d699a9d7b82f5af391c5870d239ce671
SHA512 c152c8cb9a4eef5d86dbb85b529eb3bbffa32a0da7912daaffd78cf1c2ca0b95cbc1a7b063df759ebce959e53211a34bcda1ba143c5e30956e3e0db6717c3b29

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

MD5 31277de974d31978d4013701dee62a4b
SHA1 1e82d394f4c3709215d31fa87172f31d02a198eb
SHA256 eb2a6bff370821d00b58842c80ba0564d699a9d7b82f5af391c5870d239ce671
SHA512 c152c8cb9a4eef5d86dbb85b529eb3bbffa32a0da7912daaffd78cf1c2ca0b95cbc1a7b063df759ebce959e53211a34bcda1ba143c5e30956e3e0db6717c3b29

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

MD5 31277de974d31978d4013701dee62a4b
SHA1 1e82d394f4c3709215d31fa87172f31d02a198eb
SHA256 eb2a6bff370821d00b58842c80ba0564d699a9d7b82f5af391c5870d239ce671
SHA512 c152c8cb9a4eef5d86dbb85b529eb3bbffa32a0da7912daaffd78cf1c2ca0b95cbc1a7b063df759ebce959e53211a34bcda1ba143c5e30956e3e0db6717c3b29

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

MD5 31277de974d31978d4013701dee62a4b
SHA1 1e82d394f4c3709215d31fa87172f31d02a198eb
SHA256 eb2a6bff370821d00b58842c80ba0564d699a9d7b82f5af391c5870d239ce671
SHA512 c152c8cb9a4eef5d86dbb85b529eb3bbffa32a0da7912daaffd78cf1c2ca0b95cbc1a7b063df759ebce959e53211a34bcda1ba143c5e30956e3e0db6717c3b29

memory/5612-2407-0x0000000000BD0000-0x0000000000BF7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

MD5 31277de974d31978d4013701dee62a4b
SHA1 1e82d394f4c3709215d31fa87172f31d02a198eb
SHA256 eb2a6bff370821d00b58842c80ba0564d699a9d7b82f5af391c5870d239ce671
SHA512 c152c8cb9a4eef5d86dbb85b529eb3bbffa32a0da7912daaffd78cf1c2ca0b95cbc1a7b063df759ebce959e53211a34bcda1ba143c5e30956e3e0db6717c3b29

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

MD5 31277de974d31978d4013701dee62a4b
SHA1 1e82d394f4c3709215d31fa87172f31d02a198eb
SHA256 eb2a6bff370821d00b58842c80ba0564d699a9d7b82f5af391c5870d239ce671
SHA512 c152c8cb9a4eef5d86dbb85b529eb3bbffa32a0da7912daaffd78cf1c2ca0b95cbc1a7b063df759ebce959e53211a34bcda1ba143c5e30956e3e0db6717c3b29

C:\Users\Admin\AppData\Local\Temp\2BA2.exe

MD5 31277de974d31978d4013701dee62a4b
SHA1 1e82d394f4c3709215d31fa87172f31d02a198eb
SHA256 eb2a6bff370821d00b58842c80ba0564d699a9d7b82f5af391c5870d239ce671
SHA512 c152c8cb9a4eef5d86dbb85b529eb3bbffa32a0da7912daaffd78cf1c2ca0b95cbc1a7b063df759ebce959e53211a34bcda1ba143c5e30956e3e0db6717c3b29

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\28E2.exe.log

MD5 f7047b64aa01f9d80c7a5e177ce2485c
SHA1 bab6005f4a30f12ee36b9abf6bfdfaa5411bbff8
SHA256 807356d2424d2d04f51ebd56f926d4d5a8318bc947c76569a3b5ca2c2f279915
SHA512 a9af5ace72eb66a6156a5d8764031cdc46feefffabb6898651f91a5af7f3bcef645e63e8d01ed35f1105e824d6830f6fa97e70adda2d5b148ffaff5f54ca248f

C:\Users\Admin\AppData\Local\Temp\6A7D.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\6A7D.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\WindowsSecurity\28E2.exe

MD5 86e4447c89dad11996270b6c538f2805
SHA1 a91abbd12885320ca177b5a00792156a30e72a37
SHA256 31a736e30a56614796a42b127e62900f40ca06b877941a1ad240e082b1b96aa9
SHA512 d7426ebabe1ac0d56262fef456ecdca3f991ffc72aaff9fa081bf75e614779cb71669f046b04285d2107ce0ad5ef66ed4312301ce38caa24ecd7cbf7a014609d

C:\Users\Admin\AppData\Local\WindowsSecurity\28E2.exe

MD5 86e4447c89dad11996270b6c538f2805
SHA1 a91abbd12885320ca177b5a00792156a30e72a37
SHA256 31a736e30a56614796a42b127e62900f40ca06b877941a1ad240e082b1b96aa9
SHA512 d7426ebabe1ac0d56262fef456ecdca3f991ffc72aaff9fa081bf75e614779cb71669f046b04285d2107ce0ad5ef66ed4312301ce38caa24ecd7cbf7a014609d

C:\Users\Admin\AppData\Local\WindowsSecurity\28E2.exe

MD5 86e4447c89dad11996270b6c538f2805
SHA1 a91abbd12885320ca177b5a00792156a30e72a37
SHA256 31a736e30a56614796a42b127e62900f40ca06b877941a1ad240e082b1b96aa9
SHA512 d7426ebabe1ac0d56262fef456ecdca3f991ffc72aaff9fa081bf75e614779cb71669f046b04285d2107ce0ad5ef66ed4312301ce38caa24ecd7cbf7a014609d

C:\Users\Admin\AppData\Local\Temp\6A7D.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\6A7D.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\6A7D.tmp\aa_nts.msg

MD5 3f05819f995b4dafa1b5d55ce8d1f411
SHA1 404449b79a16bfc4f64f2fd55cd73d5d27a85d71
SHA256 7e0bf0cbd06a087500a9c3b50254df3a8a2c2980921ab6a62ab1121941c80fc0
SHA512 34abb7df8b3a68e1649ff0d2762576a4d4e65da548e74b1aa65c2b82c1b89f90d053ecddac67c614ca6084dc5b2cb552949250fb70f49b536f1bcb0057717026

C:\Users\Admin\AppData\Local\Temp\F8D8.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\Update.bat

MD5 73a4d310cdd90000b9cc71223411c40f
SHA1 b068ef9b457bab0ff610047b8f277213c3f26c5b
SHA256 1cc2e10d240a44dca38dd1be915311886213e37e4c1b3006090ed7d33b0b53ff
SHA512 1adea98392da014b1a97259612f647e807cb7f0189bbe6a6689d5d1e83899943ad8647564f71ed870e4671a3cbe98614653170e26b56cce71bb820836bb796e1

C:\Users\Admin\AppData\Local\WindowsSecurity\28E2.exe

MD5 86e4447c89dad11996270b6c538f2805
SHA1 a91abbd12885320ca177b5a00792156a30e72a37
SHA256 31a736e30a56614796a42b127e62900f40ca06b877941a1ad240e082b1b96aa9
SHA512 d7426ebabe1ac0d56262fef456ecdca3f991ffc72aaff9fa081bf75e614779cb71669f046b04285d2107ce0ad5ef66ed4312301ce38caa24ecd7cbf7a014609d

C:\Users\Admin\AppData\Local\WindowsSecurity\28E2.exe

MD5 86e4447c89dad11996270b6c538f2805
SHA1 a91abbd12885320ca177b5a00792156a30e72a37
SHA256 31a736e30a56614796a42b127e62900f40ca06b877941a1ad240e082b1b96aa9
SHA512 d7426ebabe1ac0d56262fef456ecdca3f991ffc72aaff9fa081bf75e614779cb71669f046b04285d2107ce0ad5ef66ed4312301ce38caa24ecd7cbf7a014609d

C:\Users\Admin\AppData\Local\Temp\Update.bat

MD5 73a4d310cdd90000b9cc71223411c40f
SHA1 b068ef9b457bab0ff610047b8f277213c3f26c5b
SHA256 1cc2e10d240a44dca38dd1be915311886213e37e4c1b3006090ed7d33b0b53ff
SHA512 1adea98392da014b1a97259612f647e807cb7f0189bbe6a6689d5d1e83899943ad8647564f71ed870e4671a3cbe98614653170e26b56cce71bb820836bb796e1

C:\Users\Admin\AppData\Local\WindowsSecurity\28E2.exe

MD5 ffd9725b973bf9f4a3352f92de49928e
SHA1 9cd70fb77588a6e9017b453fd564b3a1d7b40734
SHA256 59effd9438a2a0eb776307fb36255def4030e24e3aa4417dc3c16b7c4532663e
SHA512 b34b11b2b7a86f536590a96c49a297cdae83304a6b7f768331c46157cb84c7b2209b7c3b9157ecf16e4c3d29a2f04301fc8dff6d53f290e767eb8f949274ded2