Malware Analysis Report

2024-10-16 05:10

Sample ID 231002-q57f9sch62
Target rh111.exe
SHA256 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
Tags
ammyyadmin flawedammyy phobos rhadamanthys smokeloader backdoor bootkit collection evasion persistence ransomware rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636

Threat Level: Known bad

The file rh111.exe was found to be: Known bad.

Malicious Activity Summary

ammyyadmin flawedammyy phobos rhadamanthys smokeloader backdoor bootkit collection evasion persistence ransomware rat spyware stealer trojan

Suspicious use of NtCreateUserProcessOtherParentProcess

Phobos

Detect rhadamanthys stealer shellcode

FlawedAmmyy RAT

Rhadamanthys

SmokeLoader

Ammyy Admin

AmmyyAdmin payload

Renames multiple (590) files with added filename extension

Deletes shadow copies

Modifies boot configuration data using bcdedit

Modifies Windows Firewall

Downloads MZ/PE file

Deletes backup catalog

Drops startup file

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Writes to the Master Boot Record (MBR)

Adds Run key to start application

Accesses Microsoft Outlook profiles

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Uses Volume Shadow Copy service COM API

Suspicious use of UnmapMainImage

outlook_office_path

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

outlook_win_path

Interacts with shadow copies

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-02 13:51

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-02 13:51

Reported

2023-10-02 13:54

Platform

win7-20230831-en

Max time kernel

118s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\rh111.exe"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 388 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 388 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe

Processes

C:\Users\Admin\AppData\Local\Temp\rh111.exe

"C:\Users\Admin\AppData\Local\Temp\rh111.exe"

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

Network

N/A

Files

memory/388-0-0x00000000002B0000-0x0000000000496000-memory.dmp

memory/388-1-0x0000000074100000-0x00000000747EE000-memory.dmp

memory/388-2-0x0000000002100000-0x0000000002178000-memory.dmp

memory/388-3-0x0000000004520000-0x0000000004560000-memory.dmp

memory/388-4-0x00000000044A0000-0x0000000004508000-memory.dmp

memory/388-5-0x00000000004C0000-0x000000000050C000-memory.dmp

memory/388-6-0x0000000074100000-0x00000000747EE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-02 13:51

Reported

2023-10-02 13:54

Platform

win10v2004-20230915-en

Max time kernel

135s

Max time network

159s

Command Line

C:\Windows\Explorer.EXE

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

FlawedAmmyy RAT

trojan flawedammyy

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4612 created 3184 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (590) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5B84.tmp\svchost.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QNJ``) = "C:\\Users\\Admin\\AppData\\Local\\QNJ``).exe" C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QNJ``) = "C:\\Users\\Admin\\AppData\\Local\\QNJ``).exe" C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-1141987721-3945596982-3297311814-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1141987721-3945596982-3297311814-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\5B84.tmp\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\116.0.1938.76\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Canary.msix.DATA C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\MedTile.scale-100.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AXSLE.dll.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\ConfirmEnter.asx C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.scale-100.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-400_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\116.0.1938.76\eventlog_provider.dll C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\NAMECONTROLPROXY.DLL.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-400_contrast-black.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ja-jp\ui-strings.js C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ru-ru\ui-strings.js C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe.manifest C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\dailymotion.luac.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Engine.resources.dll C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-core-localization-l1-2-0.dll.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-80.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MediumTile.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_field_grabber.png.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_rename_18.svg C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_contrast-white.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\subscription_intro\save-money.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldBeGreaterThan.snippets.ps1xml C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\wmpnssui.dll.mui C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libamem_plugin.dll C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\ado\msador15.dll C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\2.jpg C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-100.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xea23.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PackageManagement.CoreProviders.dll.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\vi_get.svg C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-core-processthreads-l1-1-1.dll C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-black_scale-200.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-36_contrast-black.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\ui-strings.js.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\ui-strings.js.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_bho.dll.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\artifacts.xml C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\core_zh_CN.jar.id[CA65E8CE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailWideTile.scale-150.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-250.png C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\16F9.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\192C.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5B84.tmp\svchost.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1796 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 1796 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 1796 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 1796 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 1796 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 1796 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 1796 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 1796 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 1796 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 1796 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 1796 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Users\Admin\AppData\Local\Temp\rh111.exe
PID 4612 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Windows\system32\certreq.exe
PID 4612 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Windows\system32\certreq.exe
PID 4612 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Windows\system32\certreq.exe
PID 4612 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\rh111.exe C:\Windows\system32\certreq.exe
PID 4316 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 4316 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 4316 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 628 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe
PID 628 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe
PID 628 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe
PID 628 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe
PID 628 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe
PID 628 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe
PID 4316 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 4316 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 4316 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 4316 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 4316 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 4316 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 4316 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 2088 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 2088 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 2088 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 2088 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 2088 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 2088 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 2088 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 2088 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 2088 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 2088 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe
PID 2756 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Windows\system32\cmd.exe
PID 2756 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Windows\system32\cmd.exe
PID 2756 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Windows\system32\cmd.exe
PID 2756 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe C:\Windows\system32\cmd.exe
PID 2720 wrote to memory of 516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2720 wrote to memory of 516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4576 wrote to memory of 4288 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4576 wrote to memory of 4288 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4576 wrote to memory of 1896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4576 wrote to memory of 1896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2720 wrote to memory of 4912 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2720 wrote to memory of 4912 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2720 wrote to memory of 940 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2720 wrote to memory of 940 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2720 wrote to memory of 4616 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2720 wrote to memory of 4616 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2720 wrote to memory of 2372 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2720 wrote to memory of 2372 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3184 wrote to memory of 4740 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\16F9.exe
PID 3184 wrote to memory of 4740 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\16F9.exe
PID 3184 wrote to memory of 4740 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\16F9.exe
PID 3184 wrote to memory of 396 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\192C.exe
PID 3184 wrote to memory of 396 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\192C.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\rh111.exe

"C:\Users\Admin\AppData\Local\Temp\rh111.exe"

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Users\Admin\AppData\Local\Temp\rh111.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe

"C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe"

C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe

"C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe"

C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe

C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe

C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe

C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe

C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe

"C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe"

C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe

C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Users\Admin\AppData\Local\Temp\16F9.exe

C:\Users\Admin\AppData\Local\Temp\16F9.exe

C:\Users\Admin\AppData\Local\Temp\192C.exe

C:\Users\Admin\AppData\Local\Temp\192C.exe

C:\Users\Admin\AppData\Local\Temp\16F9.exe

C:\Users\Admin\AppData\Local\Temp\16F9.exe

C:\Users\Admin\AppData\Local\Temp\16F9.exe

C:\Users\Admin\AppData\Local\Temp\16F9.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\16F9.exe

C:\Users\Admin\AppData\Local\Temp\16F9.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\192C.exe

"C:\Users\Admin\AppData\Local\Temp\192C.exe"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\5B84.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\5B84.tmp\svchost.exe -debug

C:\Windows\SYSTEM32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5B84.tmp\aa_nts.dll",run

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 61.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 254.111.26.67.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 254.22.238.8.in-addr.arpa udp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 120.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 xemtex534.xyz udp
DE 212.87.212.222:80 xemtex534.xyz tcp
US 8.8.8.8:53 222.212.87.212.in-addr.arpa udp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.242:443 tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 148.129.42.188.in-addr.arpa udp
US 8.8.8.8:53 242.104.243.136.in-addr.arpa udp
US 8.8.8.8:53 www.ammyy.com udp
DE 136.243.18.118:80 www.ammyy.com tcp
DE 136.243.18.118:443 www.ammyy.com tcp
US 8.8.8.8:53 118.18.243.136.in-addr.arpa udp
US 8.8.8.8:53 147.174.42.23.in-addr.arpa udp
US 8.8.8.8:53 75.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp
DE 85.10.193.215:80 tcp
US 8.8.8.8:53 215.193.10.85.in-addr.arpa udp

Files

memory/1796-0-0x0000000000740000-0x0000000000926000-memory.dmp

memory/1796-1-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/1796-2-0x00000000053F0000-0x0000000005468000-memory.dmp

memory/1796-3-0x0000000005540000-0x0000000005550000-memory.dmp

memory/1796-4-0x0000000005470000-0x00000000054D8000-memory.dmp

memory/1796-5-0x00000000054E0000-0x000000000552C000-memory.dmp

memory/1796-6-0x0000000005B30000-0x00000000060D4000-memory.dmp

memory/4612-7-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1796-11-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/4612-10-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4612-12-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4612-13-0x0000000001210000-0x0000000001217000-memory.dmp

memory/4612-14-0x0000000002EA0000-0x00000000032A0000-memory.dmp

memory/4612-15-0x0000000002EA0000-0x00000000032A0000-memory.dmp

memory/4612-16-0x0000000002EA0000-0x00000000032A0000-memory.dmp

memory/4612-17-0x0000000002EA0000-0x00000000032A0000-memory.dmp

memory/3284-18-0x00000195D4E30000-0x00000195D4E33000-memory.dmp

memory/4612-19-0x0000000003D20000-0x0000000003D56000-memory.dmp

memory/4612-25-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4612-26-0x0000000003D20000-0x0000000003D56000-memory.dmp

memory/4612-27-0x0000000002EA0000-0x00000000032A0000-memory.dmp

memory/4612-28-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4612-29-0x0000000002EA0000-0x00000000032A0000-memory.dmp

memory/3284-30-0x00000195D4E30000-0x00000195D4E33000-memory.dmp

memory/3284-31-0x00000195D5090000-0x00000195D5097000-memory.dmp

memory/3284-33-0x00007FF452EE0000-0x00007FF45300F000-memory.dmp

memory/3284-32-0x00007FF452EE0000-0x00007FF45300F000-memory.dmp

memory/3284-35-0x00007FF452EE0000-0x00007FF45300F000-memory.dmp

memory/3284-34-0x00007FF452EE0000-0x00007FF45300F000-memory.dmp

memory/3284-36-0x00007FF452EE0000-0x00007FF45300F000-memory.dmp

memory/3284-38-0x00007FF452EE0000-0x00007FF45300F000-memory.dmp

memory/3284-40-0x00007FF452EE0000-0x00007FF45300F000-memory.dmp

memory/3284-41-0x00007FF452EE0000-0x00007FF45300F000-memory.dmp

memory/3284-42-0x00007FF452EE0000-0x00007FF45300F000-memory.dmp

memory/3284-43-0x00007FFA0EA70000-0x00007FFA0EC65000-memory.dmp

memory/3284-44-0x00007FF452EE0000-0x00007FF45300F000-memory.dmp

memory/3284-45-0x00007FF452EE0000-0x00007FF45300F000-memory.dmp

memory/3284-46-0x00007FF452EE0000-0x00007FF45300F000-memory.dmp

memory/3284-47-0x00007FF452EE0000-0x00007FF45300F000-memory.dmp

memory/3284-48-0x00007FF452EE0000-0x00007FF45300F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe

MD5 0feba1aa950a86bc42ea915dd0cf7d11
SHA1 7547e1c5f62deca33ab889d5c96a87119f4a951e
SHA256 eff61b0a07c25e5b581608ad5ad70bceecd2e777d902263c74e1bc3f17760141
SHA512 65da25a685620e31de954f8bfc26eea309fc735df68fcb81428a744eb03b6c083cac9410e1eb73dee7d04a42e46096d62508d5fdafdc16f8f8748658e07c0b9c

C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe

MD5 0feba1aa950a86bc42ea915dd0cf7d11
SHA1 7547e1c5f62deca33ab889d5c96a87119f4a951e
SHA256 eff61b0a07c25e5b581608ad5ad70bceecd2e777d902263c74e1bc3f17760141
SHA512 65da25a685620e31de954f8bfc26eea309fc735df68fcb81428a744eb03b6c083cac9410e1eb73dee7d04a42e46096d62508d5fdafdc16f8f8748658e07c0b9c

memory/3284-54-0x00007FFA0EA70000-0x00007FFA0EC65000-memory.dmp

memory/628-53-0x0000000000BF0000-0x0000000000C34000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe

MD5 c2317e46c10621501b8fb1022136b0c3
SHA1 982a7c80f27f9dd71b8214e07c7beb81c13d3ec7
SHA256 fa620f37539b2c7e53d4c06de1b680d0eab5c3a5280b89d1700e014bfd320519
SHA512 2b28c632bda2a059f7725d28ee068f397385bf09714fbb8ad9b76f3b826d7bda9051d87911e29ba2bb36e5288441d06bc0f8ba85a1f28514ca22f7f07ed5850d

C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe

MD5 c2317e46c10621501b8fb1022136b0c3
SHA1 982a7c80f27f9dd71b8214e07c7beb81c13d3ec7
SHA256 fa620f37539b2c7e53d4c06de1b680d0eab5c3a5280b89d1700e014bfd320519
SHA512 2b28c632bda2a059f7725d28ee068f397385bf09714fbb8ad9b76f3b826d7bda9051d87911e29ba2bb36e5288441d06bc0f8ba85a1f28514ca22f7f07ed5850d

memory/628-59-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/4316-58-0x00000000002C0000-0x0000000000308000-memory.dmp

memory/628-57-0x0000000005460000-0x00000000054A4000-memory.dmp

memory/628-60-0x0000000005450000-0x0000000005460000-memory.dmp

memory/628-62-0x00000000054D0000-0x0000000005502000-memory.dmp

memory/4316-61-0x0000000000CA0000-0x0000000000CE6000-memory.dmp

memory/4316-63-0x00000000026F0000-0x0000000002724000-memory.dmp

memory/4316-64-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/540-65-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2756-66-0x0000000000400000-0x0000000000413000-memory.dmp

memory/628-73-0x00000000747C0000-0x0000000074F70000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe

MD5 c2317e46c10621501b8fb1022136b0c3
SHA1 982a7c80f27f9dd71b8214e07c7beb81c13d3ec7
SHA256 fa620f37539b2c7e53d4c06de1b680d0eab5c3a5280b89d1700e014bfd320519
SHA512 2b28c632bda2a059f7725d28ee068f397385bf09714fbb8ad9b76f3b826d7bda9051d87911e29ba2bb36e5288441d06bc0f8ba85a1f28514ca22f7f07ed5850d

C:\Users\Admin\AppData\Local\Microsoft\m48J7[lqq.exe

MD5 0feba1aa950a86bc42ea915dd0cf7d11
SHA1 7547e1c5f62deca33ab889d5c96a87119f4a951e
SHA256 eff61b0a07c25e5b581608ad5ad70bceecd2e777d902263c74e1bc3f17760141
SHA512 65da25a685620e31de954f8bfc26eea309fc735df68fcb81428a744eb03b6c083cac9410e1eb73dee7d04a42e46096d62508d5fdafdc16f8f8748658e07c0b9c

memory/540-72-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2756-75-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4316-74-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/2756-76-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe

MD5 c2317e46c10621501b8fb1022136b0c3
SHA1 982a7c80f27f9dd71b8214e07c7beb81c13d3ec7
SHA256 fa620f37539b2c7e53d4c06de1b680d0eab5c3a5280b89d1700e014bfd320519
SHA512 2b28c632bda2a059f7725d28ee068f397385bf09714fbb8ad9b76f3b826d7bda9051d87911e29ba2bb36e5288441d06bc0f8ba85a1f28514ca22f7f07ed5850d

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QNJ``).exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

memory/2088-80-0x0000000002630000-0x0000000002676000-memory.dmp

memory/2088-79-0x0000000074860000-0x0000000075010000-memory.dmp

memory/2088-81-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\QNJ``).exe

MD5 c2317e46c10621501b8fb1022136b0c3
SHA1 982a7c80f27f9dd71b8214e07c7beb81c13d3ec7
SHA256 fa620f37539b2c7e53d4c06de1b680d0eab5c3a5280b89d1700e014bfd320519
SHA512 2b28c632bda2a059f7725d28ee068f397385bf09714fbb8ad9b76f3b826d7bda9051d87911e29ba2bb36e5288441d06bc0f8ba85a1f28514ca22f7f07ed5850d

memory/2088-86-0x0000000074860000-0x0000000075010000-memory.dmp

memory/3872-87-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3284-88-0x00000195D5090000-0x00000195D5095000-memory.dmp

memory/3284-89-0x00007FFA0EA70000-0x00007FFA0EC65000-memory.dmp

memory/3184-90-0x00000000005B0000-0x00000000005C6000-memory.dmp

memory/540-91-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2756-104-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2756-107-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2756-108-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2756-109-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2756-110-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2756-225-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2756-127-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2756-119-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2756-233-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2756-254-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2756-268-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2756-255-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[CA65E8CE-3483].[[email protected]].8base

MD5 14cecfa5feaf28627427288fe97f88a5
SHA1 9acc0df2a8dfde42d3434e41304fe437935d764f
SHA256 f4aa784080f8131b173cf9eca70a3dd11a0c089de3eb1a420ef00b91aed8c29f
SHA512 c307a57f3314644705e1bdb0300b0be8e568126563c9d6e97c5741eaab9d817db0fb29c2f895e0d39575904c28c9cb9af7466a3eb8f8eb9ae9a4b6855e9bfe0e

memory/2756-113-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2756-105-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2756-466-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\16F9.exe

MD5 c2317e46c10621501b8fb1022136b0c3
SHA1 982a7c80f27f9dd71b8214e07c7beb81c13d3ec7
SHA256 fa620f37539b2c7e53d4c06de1b680d0eab5c3a5280b89d1700e014bfd320519
SHA512 2b28c632bda2a059f7725d28ee068f397385bf09714fbb8ad9b76f3b826d7bda9051d87911e29ba2bb36e5288441d06bc0f8ba85a1f28514ca22f7f07ed5850d

C:\Users\Admin\AppData\Local\Temp\16F9.exe

MD5 c2317e46c10621501b8fb1022136b0c3
SHA1 982a7c80f27f9dd71b8214e07c7beb81c13d3ec7
SHA256 fa620f37539b2c7e53d4c06de1b680d0eab5c3a5280b89d1700e014bfd320519
SHA512 2b28c632bda2a059f7725d28ee068f397385bf09714fbb8ad9b76f3b826d7bda9051d87911e29ba2bb36e5288441d06bc0f8ba85a1f28514ca22f7f07ed5850d

C:\Users\Admin\AppData\Local\Temp\16F9.exe

MD5 c2317e46c10621501b8fb1022136b0c3
SHA1 982a7c80f27f9dd71b8214e07c7beb81c13d3ec7
SHA256 fa620f37539b2c7e53d4c06de1b680d0eab5c3a5280b89d1700e014bfd320519
SHA512 2b28c632bda2a059f7725d28ee068f397385bf09714fbb8ad9b76f3b826d7bda9051d87911e29ba2bb36e5288441d06bc0f8ba85a1f28514ca22f7f07ed5850d

memory/4740-3723-0x00000000746A0000-0x0000000074E50000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\192C.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\192C.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/4740-3730-0x0000000002580000-0x00000000025C6000-memory.dmp

memory/396-3759-0x00000000746A0000-0x0000000074E50000-memory.dmp

memory/396-3758-0x00000000004F0000-0x000000000056C000-memory.dmp

memory/4740-3768-0x0000000004D00000-0x0000000004D10000-memory.dmp

memory/396-3786-0x0000000005330000-0x00000000053C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\16F9.exe

MD5 c2317e46c10621501b8fb1022136b0c3
SHA1 982a7c80f27f9dd71b8214e07c7beb81c13d3ec7
SHA256 fa620f37539b2c7e53d4c06de1b680d0eab5c3a5280b89d1700e014bfd320519
SHA512 2b28c632bda2a059f7725d28ee068f397385bf09714fbb8ad9b76f3b826d7bda9051d87911e29ba2bb36e5288441d06bc0f8ba85a1f28514ca22f7f07ed5850d

C:\Users\Admin\AppData\Local\Temp\16F9.exe

MD5 c2317e46c10621501b8fb1022136b0c3
SHA1 982a7c80f27f9dd71b8214e07c7beb81c13d3ec7
SHA256 fa620f37539b2c7e53d4c06de1b680d0eab5c3a5280b89d1700e014bfd320519
SHA512 2b28c632bda2a059f7725d28ee068f397385bf09714fbb8ad9b76f3b826d7bda9051d87911e29ba2bb36e5288441d06bc0f8ba85a1f28514ca22f7f07ed5850d

C:\Users\Admin\AppData\Local\Temp\16F9.exe

MD5 c2317e46c10621501b8fb1022136b0c3
SHA1 982a7c80f27f9dd71b8214e07c7beb81c13d3ec7
SHA256 fa620f37539b2c7e53d4c06de1b680d0eab5c3a5280b89d1700e014bfd320519
SHA512 2b28c632bda2a059f7725d28ee068f397385bf09714fbb8ad9b76f3b826d7bda9051d87911e29ba2bb36e5288441d06bc0f8ba85a1f28514ca22f7f07ed5850d

memory/4740-3830-0x00000000746A0000-0x0000000074E50000-memory.dmp

memory/396-3818-0x00000000053D0000-0x000000000546C000-memory.dmp

memory/1648-3833-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1708-3864-0x0000000000F40000-0x0000000000FB5000-memory.dmp

memory/1708-3897-0x0000000000ED0000-0x0000000000F3B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x00o19f5.default-release\cookies.sqlite.id[CA65E8CE-3483].[[email protected]].8base

MD5 e42e0b9ce40c2ddd2cac886f485ecede
SHA1 3039baf11b5fd2e65f0f20ada1f82a42bfedc934
SHA256 b22e4fa2e82011aeb9b451f87647cbbe1113b55c2e8be27dd9af01d7989c37c1
SHA512 4da6c72b4336e84ae3889db516613fc53d00b4f0de0e9e49dddc291726d25db8d6c7288f5ba47e4a55a0f5243f1c030a96cae23c4202c7f5a5e61aedd858dc58

memory/396-3951-0x0000000006230000-0x0000000006240000-memory.dmp

memory/396-3984-0x00000000061C0000-0x0000000006202000-memory.dmp

memory/408-4020-0x0000000000D30000-0x0000000000D37000-memory.dmp

memory/408-4021-0x0000000000D20000-0x0000000000D2C000-memory.dmp

memory/396-4127-0x0000000006490000-0x000000000649A000-memory.dmp

memory/1708-4179-0x0000000000ED0000-0x0000000000F3B000-memory.dmp

memory/760-4246-0x0000000001290000-0x0000000001294000-memory.dmp

memory/396-4285-0x00000000746A0000-0x0000000074E50000-memory.dmp

memory/760-4294-0x0000000001280000-0x0000000001289000-memory.dmp

memory/3716-4375-0x00000000003D0000-0x00000000003DA000-memory.dmp

memory/3716-4388-0x00000000003C0000-0x00000000003CB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5B84.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\5B84.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\5B84.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\5B84.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\5B84.tmp\aa_nts.msg

MD5 3f05819f995b4dafa1b5d55ce8d1f411
SHA1 404449b79a16bfc4f64f2fd55cd73d5d27a85d71
SHA256 7e0bf0cbd06a087500a9c3b50254df3a8a2c2980921ab6a62ab1121941c80fc0
SHA512 34abb7df8b3a68e1649ff0d2762576a4d4e65da548e74b1aa65c2b82c1b89f90d053ecddac67c614ca6084dc5b2cb552949250fb70f49b536f1bcb0057717026

C:\Users\Admin\AppData\Local\Temp\192C.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rh111.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\m48J7[lqq.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\192C.exe.log

MD5 84e77a587d94307c0ac1357eb4d3d46f
SHA1 83cc900f9401f43d181207d64c5adba7a85edc1e
SHA256 e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
SHA512 aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\16F9.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002a.db.id[CA65E8CE-3483].[[email protected]].8base

MD5 4b4b381d1463defe1ed89cac8a96fb55
SHA1 7bba685d8f421e17944229ba8c1073fe51b88d8e
SHA256 85dbbe6cc36c852829d81ee63e5d1e55b72f7e9807781e8b7f7a2ba540cf3dab
SHA512 882d6052a2781176288cad824fb09141c9f89fce62ad1abe005548475e7068b9a4339157705eb48fb6b53277d118b80ae5f3d56f347ed6e60bc65839f5fb1069

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Windows\System32\WalletProxy.dll

MD5 d09724c29a8f321f2f9c552de6ef6afa
SHA1 d6ce3d3a973695f4f770e7fb3fcb5e2f3df592a3
SHA256 23cc82878957683184fbd0e3098e9e6858978bf78d7812c6d7470ebdc79d1c5c
SHA512 cc8db1b0c4bbd94dfc8a669cd6accf6fa29dc1034ce03d9dae53d6ce117bb86b432bf040fb53230b612c6e9a325e58acc8ebb600f760a8d9d6a383ce751fd6ed

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Windows\System32\Windows.ApplicationModel.Wallet.dll

MD5 02557c141c9e153c2b7987b79a3a2dd7
SHA1 a054761382ee68608b6a3b62b68138dc205f576b
SHA256 207c587e769e2655669bd3ce1d28a00bcac08f023013735f026f65c0e3baa6f4
SHA512 a37e29c115bcb9956b1f8fd2022f2e3966c1fa2a0efa5c2ee2d14bc5c41bfddae0deea4d481a681d13ec58e9dec41e7565f8b4eb1c10f2c44c03e58bdd2792b3

C:\Users\Admin\AppData\Local\Temp\5B84.tmp\aa_nts.log

MD5 6cb69f8fa44180a75b5cd6d0e6ff1a43
SHA1 131f0bb800aa929ba67e8771b62884eb162de542
SHA256 80fe0f50bdaf315bfb2e60b52b707434f4450f46ca9f85d71c25f8c7768aa40a
SHA512 45c57ee0df46367af50aa7ddefd46654ad19627edc007ce727eca9c1020e10d2be73770f949abce90182ccc1165b0026e95703230dce1e0580e24822c3b8a986

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Windows\SysWOW64\Windows.ApplicationModel.Wallet.dll

MD5 02557c141c9e153c2b7987b79a3a2dd7
SHA1 a054761382ee68608b6a3b62b68138dc205f576b
SHA256 207c587e769e2655669bd3ce1d28a00bcac08f023013735f026f65c0e3baa6f4
SHA512 a37e29c115bcb9956b1f8fd2022f2e3966c1fa2a0efa5c2ee2d14bc5c41bfddae0deea4d481a681d13ec58e9dec41e7565f8b4eb1c10f2c44c03e58bdd2792b3

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe

MD5 cfe72ed40a076ae4f4157940ce0c5d44
SHA1 8010f7c746a7ba4864785f798f46ec05caae7ece
SHA256 6868894ab04d08956388a94a81016f03d5b7a7b1646c8a6235057a7e1e45de32
SHA512 f002afa2131d250dd6148d8372ce45f84283b8e1209e91720cee7aff497503d0e566bae3a83cd326701458230ae5c0e200eec617889393dd46ac00ff357ff1b0

C:\Users\Admin\AppData\Local\Temp\5B84.tmp\settings3.bin

MD5 738f309b0065322d607cd2109966f9f4
SHA1 0c61e925cc64b28bb7a7eb28138c07546abc366c
SHA256 8baceb97bc8e076453eff633cb3f5ed0a9849c398799eeef2bd8eb2ef75fd251
SHA512 a08bc83ff5bcf38ee64b0196ff7672597b41d0e0318f6977d377cffbf8c429fc4d31bb4b05a8e7072a5e40e0d75247b1822709b3d8b5c40ab267f3eee63f862d

C:\Users\Admin\AppData\Local\Temp\5B84.tmp\hr3

MD5 5b3a5065816f136f0553b0adbb975dc6
SHA1 4eccc21faeed30e9aef86a0c1c9c8326b1ef8928
SHA256 aa24d0d2a6726bee28af40b82cacc70a5ed42e62ce0641bffc71e40d9e75aae9
SHA512 40ef97348ff27fda04df841ee7967d68297980cc19ff5f63a793457289732789319a541ae1864e4359909b3f7f76b1d4cf6a1aa80b09c67250079c03e212ad7c

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Windows\System32\WalletBackgroundServiceProxy.dll

MD5 1097d1e58872f3cf58f78730a697ce4b
SHA1 96db4e4763a957b28dd80ec1e43eb27367869b86
SHA256 83ec0be293b19d00eca4ae51f16621753e1d2b11248786b25a1abaae6230bdef
SHA512 b933eac4eaabacc51069a72b24b649b980aea251b1b87270ff4ffea12de9368d5447cdbe748ac7faf2805548b896c8499f9eceeed2f5efd0c684f94360940351

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe.xml

MD5 108f130067a9df1719c590316a5245f7
SHA1 79bb9a86e7a50c85214cd7e21719f0cb4155f58a
SHA256 c91debd34057ca5c280ca15ac542733930e1c94c7d887448eac6e3385b5a0874
SHA512 d43b3861d5153c7ca54edd078c900d31599fc9f04d6883a449d62c7e86a105a3c5dfb2d232255c41505b210b063caf6325921dc074fcdf93407c9e2c985a5301

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe.xml

MD5 94f90fcd2b8f7f1df69224f845d9e9b7
SHA1 a09e3072cc581cf89adaf1aa20aa89b3af7bf987
SHA256 a16113a66b1c36f919b5f7eaa3fb7aa8e0ba9e057823861aabea703cc06a04c0
SHA512 51f4ee06a8d8bf1121083bf4383433160f16c68d1fe4c44e5d0e0529910d27ba8446c7a4bef359b990574d1d61563da30139c6d09ad0ad1a5b5c7748b8da08f3

C:\Users\Admin\AppData\Local\Temp\4AEA\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe.xml

MD5 108f130067a9df1719c590316a5245f7
SHA1 79bb9a86e7a50c85214cd7e21719f0cb4155f58a
SHA256 c91debd34057ca5c280ca15ac542733930e1c94c7d887448eac6e3385b5a0874
SHA512 d43b3861d5153c7ca54edd078c900d31599fc9f04d6883a449d62c7e86a105a3c5dfb2d232255c41505b210b063caf6325921dc074fcdf93407c9e2c985a5301

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5037AC1E573F140500110A0B67548B5E

MD5 74b5e022a7a0d59c9d03146a628f5fd0
SHA1 6aeba1f1f9f094a36957d53a14860b1599696705
SHA256 4f4039ca8d5ce42470e43f887cb59741f10dc6d629669db20c559cd25372369c
SHA512 2045e903fe8dc0bdef69b2ee8fce81fbb0c665e69fc7b0b5d1b841327d55ab50317285ca7a5ff40f5f9e044c89ab797e75ba4e898ab8b31cde18cc5ebff49921

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5037AC1E573F140500110A0B67548B5E

MD5 405ebdb307908dd2a8a41f2555702a21
SHA1 4056fbd08e4ea5fe71fb2b96bafa60e4a2885e81
SHA256 7f0e8abfea6b034578061c05a1e566e8252acfddd53e6b5696d3bb483bbf2178
SHA512 ac59868e67b8725006484971e3a1dca137e22f22c9945f429dcc8cda7b5bd913a8e8c52233725a03f8aafb0ff00bb19536d6308b2ffd1e6974e8ed57d425c329

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

MD5 c4530ad4a48d098279e175879dd9c9a0
SHA1 438fc3ca54fbd055fff4d56a3f2d68d3f32afffc
SHA256 5b0866b68ca56752c313172c127be89d483fdd68ca763fd6099075d11a919d2c
SHA512 e7875491b403174baec6e4070c2f7bf48979f85553a61399adcafcceb4d255ae02445fdd2f2936f27b1e6f569260081f1ef64a490066388a2b0898703a0fbdb3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

MD5 60fe01df86be2e5331b0cdbe86165686
SHA1 2a79f9713c3f192862ff80508062e64e8e0b29bd
SHA256 c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8
SHA512 ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

C:\Users\Admin\AppData\Local\Temp\4AEA\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe.xml

MD5 94f90fcd2b8f7f1df69224f845d9e9b7
SHA1 a09e3072cc581cf89adaf1aa20aa89b3af7bf987
SHA256 a16113a66b1c36f919b5f7eaa3fb7aa8e0ba9e057823861aabea703cc06a04c0
SHA512 51f4ee06a8d8bf1121083bf4383433160f16c68d1fe4c44e5d0e0529910d27ba8446c7a4bef359b990574d1d61563da30139c6d09ad0ad1a5b5c7748b8da08f3

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Windows\SysWOW64\WalletProxy.dll

MD5 d09724c29a8f321f2f9c552de6ef6afa
SHA1 d6ce3d3a973695f4f770e7fb3fcb5e2f3df592a3
SHA256 23cc82878957683184fbd0e3098e9e6858978bf78d7812c6d7470ebdc79d1c5c
SHA512 cc8db1b0c4bbd94dfc8a669cd6accf6fa29dc1034ce03d9dae53d6ce117bb86b432bf040fb53230b612c6e9a325e58acc8ebb600f760a8d9d6a383ce751fd6ed

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Windows\SysWOW64\WalletBackgroundServiceProxy.dll

MD5 1097d1e58872f3cf58f78730a697ce4b
SHA1 96db4e4763a957b28dd80ec1e43eb27367869b86
SHA256 83ec0be293b19d00eca4ae51f16621753e1d2b11248786b25a1abaae6230bdef
SHA512 b933eac4eaabacc51069a72b24b649b980aea251b1b87270ff4ffea12de9368d5447cdbe748ac7faf2805548b896c8499f9eceeed2f5efd0c684f94360940351

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.dll

MD5 8be414e4908b931ce45f42329d9360eb
SHA1 e66efb8a4df00ff1f236f65dbd323dc68e1f63e4
SHA256 e94dd07d628fc42e51b78d8b6a35293328313366093a0f5508dfe533815ced07
SHA512 233a6ce55891481deae9d527cb6296c8093fa3face48858d7d58cc65cb0c35eb56390593bdcf366caa363c9670996c1776e74b42be84a04382799293abab7a49

C:\Users\Admin\AppData\Roaming\jvtrgfv

MD5 0feba1aa950a86bc42ea915dd0cf7d11
SHA1 7547e1c5f62deca33ab889d5c96a87119f4a951e
SHA256 eff61b0a07c25e5b581608ad5ad70bceecd2e777d902263c74e1bc3f17760141
SHA512 65da25a685620e31de954f8bfc26eea309fc735df68fcb81428a744eb03b6c083cac9410e1eb73dee7d04a42e46096d62508d5fdafdc16f8f8748658e07c0b9c

C:\Users\Admin\AppData\Roaming\saddjsb

MD5 6e038a129bd84d2bf706e959f58fcc4b
SHA1 770d38b6b19fdef278043e7f848dc0b868207c3f
SHA256 cfa469065ed6993300506303d3c7d789cd24209905a13200b0ba1468a082514e
SHA512 66309a4d000848233b8b8ec4fdfe9228b2a28d1e39ed371de12c02e6cb8f838c208c5db05fd370090efaea94a40f6ffbf3ea7ab426542bda1a216cf4cb0f1ac3

C:\info.hta

MD5 e6f452d37338b3dcfe9869f20087ce91
SHA1 d09f17e7563485a59f3ff1f4af1eb469c49ac251
SHA256 c7859805407693ab1e1971a1b32bd36aa1e4c1a015bc2561b09adaedaddf4049
SHA512 4455361b6735d579e6723846daaf892ebb7f44bf81c5490c0c9d5c8bc80652fa68c00ab4704a7739d47e34aca199b8cbdf957bf147d50ee0117f0fefa838641f

C:\users\public\desktop\info.hta

MD5 e6f452d37338b3dcfe9869f20087ce91
SHA1 d09f17e7563485a59f3ff1f4af1eb469c49ac251
SHA256 c7859805407693ab1e1971a1b32bd36aa1e4c1a015bc2561b09adaedaddf4049
SHA512 4455361b6735d579e6723846daaf892ebb7f44bf81c5490c0c9d5c8bc80652fa68c00ab4704a7739d47e34aca199b8cbdf957bf147d50ee0117f0fefa838641f

C:\Users\Admin\Desktop\info.hta

MD5 e6f452d37338b3dcfe9869f20087ce91
SHA1 d09f17e7563485a59f3ff1f4af1eb469c49ac251
SHA256 c7859805407693ab1e1971a1b32bd36aa1e4c1a015bc2561b09adaedaddf4049
SHA512 4455361b6735d579e6723846daaf892ebb7f44bf81c5490c0c9d5c8bc80652fa68c00ab4704a7739d47e34aca199b8cbdf957bf147d50ee0117f0fefa838641f

C:\info.hta

MD5 e6f452d37338b3dcfe9869f20087ce91
SHA1 d09f17e7563485a59f3ff1f4af1eb469c49ac251
SHA256 c7859805407693ab1e1971a1b32bd36aa1e4c1a015bc2561b09adaedaddf4049
SHA512 4455361b6735d579e6723846daaf892ebb7f44bf81c5490c0c9d5c8bc80652fa68c00ab4704a7739d47e34aca199b8cbdf957bf147d50ee0117f0fefa838641f

F:\info.hta

MD5 e6f452d37338b3dcfe9869f20087ce91
SHA1 d09f17e7563485a59f3ff1f4af1eb469c49ac251
SHA256 c7859805407693ab1e1971a1b32bd36aa1e4c1a015bc2561b09adaedaddf4049
SHA512 4455361b6735d579e6723846daaf892ebb7f44bf81c5490c0c9d5c8bc80652fa68c00ab4704a7739d47e34aca199b8cbdf957bf147d50ee0117f0fefa838641f

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.dll.id[CA65E8CE-3483].[[email protected]].8base

MD5 85617b5972ba91c166bfbc0f174333f8
SHA1 18aff644131ab5b0890789c5d0f0148ff6ea5299
SHA256 35629e3a4d6fe10ce0a488790d5284a3a5d8a0b69d349b1d5f13974ccf0139a2
SHA512 0ddf5ae606118924bac3bd414e14e48352084dd7e88c435e78de461d7b500cccf63b8b97a331a65c9ba54dc619235e828b0a54c3e255b1aca5472d1c2cd0c965

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Windows\SysWOW64\WalletProxy.dll.id[CA65E8CE-3483].[[email protected]].8base

MD5 2e918d58c64faa518d299588b8bb59b0
SHA1 710185dfb2bb539222dc26abbf94d7e4948d353b
SHA256 0603ff79d39312cafeb67ee209ae554b67060ad231780f1331a988ba471602e1
SHA512 9d8a9c3e728d58ecca2e3c8e175df377554c7e56ad5eb2f00557b63c14705510021416607146840dc0d9a1da80dd9bd2b9cce07681049d8ac5c65fdb93a6b514

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Windows\SysWOW64\WalletBackgroundServiceProxy.dll.id[CA65E8CE-3483].[[email protected]].8base

MD5 4da66d85b28eb00a3d9a902dbfb441f1
SHA1 04fe3452aa3882886571cd0ca2b3d0001b6ac719
SHA256 05540c89aff90bbb75e124cbf13afb8236e391f180731ef10ac932d057aa8e29
SHA512 0bb676b1fedd6f918304654987f3ce6eae81e1bfee6a68f5c7245dd931709d8eb0d68b33b89b01c979cb7979f92ef5c2287ed8a21c0615f22351212fae356f05

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Windows\System32\Windows.ApplicationModel.Wallet.dll.id[CA65E8CE-3483].[[email protected]].8base

MD5 4276ad74aa25849df833f788eb7add2c
SHA1 5833aadc83f7c1a26988079077b3758fe61544af
SHA256 b9e3f7b087dddbd44af64ea1ab979479415b29283028d352d29fe3dd753a3e11
SHA512 8463a4ffce357e9e34c26fddeb0f904acd17ac45ea122994ad05a61d22a3bf163b5331348cf78536ed2d2206f049a1261279d95f46d993ae871e8cc4b17fe2e9

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Windows\System32\WalletProxy.dll.id[CA65E8CE-3483].[[email protected]].8base

MD5 71ca848f30f2d6329755da21c05ea3e0
SHA1 138f91c58ff4b2802724d197f2f4938004aec3a8
SHA256 2d106c24d4e4341c5648ca72e41ad419430163464cc435a14a70a6322f9ee4b2
SHA512 5493ae1565a3bc3994002092e3ff6a840d41c5fe8f41ef079fcdb6b4e13e54994b3a6785b055e6f60a63e4dc6bafe9334db462b9cfed69b364929a3f161de10b

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Windows\System32\WalletBackgroundServiceProxy.dll.id[CA65E8CE-3483].[[email protected]].8base

MD5 09a63047fd80d8f37d7e6b0e58487a6b
SHA1 09845a011db83e73d494b693173c64523dd68a73
SHA256 76c456bb9227914d13cc72e8b20e41eb8cc1db7f4f20ed00f6353c4e29fc20d7
SHA512 51f69ed47850ee3d66e7a87389c38e723377a865ae6d3be1f89c9e4d6877a2b8bb907b2947810d3caff02ba20a6baa0dff0f9ba6d4d80cd9ca19f3936c039853

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe.xml.id[CA65E8CE-3483].[[email protected]].8base

MD5 e6da7f3ca3c115974059c53f4041c80d
SHA1 525d7064930b6bd2b029667382a8514c3eb596f1
SHA256 ccd5d9f70a416a3c95feedea5d3e7abf0a506e3ba9e6a5f67120a22231d09f8d
SHA512 c8dd34b446e04c20e161e39f9fcb0c1a39e833860a430decce22a13b25e665c9d0822d87e10cfba7cc8c2af1d87c1e84c8701422162b0827ceb560e025452e6e

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Users\All Users\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe.xml.id[CA65E8CE-3483].[[email protected]].8base

MD5 eded5398c19b7dcf7b022407c75963ea
SHA1 483203a2a986db38123b34a2928987da3bb2f4e4
SHA256 f3a9daeddb8f4bef5238c84cde7f2c7a42d2089f64f57325102b714016cc32d8
SHA512 669b3ab802a62f9918bb8f6289f8788542eaedf02d914deaebdd9b4b4a12cdc551f337c498969696db3a5c4f1792847672415ce9187eef00985aea1cb357c7c4

C:\Users\Admin\AppData\Local\Temp\4AEA\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe.xml.id[CA65E8CE-3483].[[email protected]].8base

MD5 86f1a10aaf6ef377d2a8d8925b18bb5d
SHA1 463b5a51991228b817a4e4c0ad1d031a871f3d5c
SHA256 811521fb63eef8bb4fc01b4714b502a11d4391f893a07f6bdf77e32fb872ddbc
SHA512 ac0a58da70fb86a29bfc26e4b42e6a2a1185972dfaaa8e317c8429c085547f48b7ac8c8334f16433c3ea62c6d502ae5b8bfa41a3bbe29b804647f9d5eb4fdd26

C:\Users\Admin\AppData\Local\Temp\4AEA\C\ProgramData\Microsoft\Windows\AppRepository\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe.xml.id[CA65E8CE-3483].[[email protected]].8base

MD5 869ae030b333e6c349431b5533c3f6af
SHA1 4ebdcf969b5c7c598d01321ef2e84f12144962cd
SHA256 afd91ec8181ee3e685a38f8276fca554c91ea2e532153ddbba363bf49d607a34
SHA512 43ce508ce2fdb4b8ca2a4febe7985e47c5ae7d30efea426bf925023ebe390dc16a321756a466ae93515b2b8a1d88b98559654ff9ca46a6c217a6807a5694320d

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe.id[CA65E8CE-3483].[[email protected]].8base

MD5 d126b2ff111de65e2a69f24546ebb96e
SHA1 5b8259ffcaf1b16392157f4ebc6da7e51ee0a020
SHA256 5e0273c7a3e01d700e3f660228cccc791cbebc6f499c5aa2ad6982f2652fe00f
SHA512 9f87adb19ff13e4c5bf1b4250311c61d803ef58a68286ba0616261c60b3e24f2a893ad8343b6930464b7348a8e1f79d1af8d937f73e1cbb82a966d9a4f7b11b0

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Windows\WinSxS\wow64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_69993b7d6814452d\WalletProxy.dll

MD5 d09724c29a8f321f2f9c552de6ef6afa
SHA1 d6ce3d3a973695f4f770e7fb3fcb5e2f3df592a3
SHA256 23cc82878957683184fbd0e3098e9e6858978bf78d7812c6d7470ebdc79d1c5c
SHA512 cc8db1b0c4bbd94dfc8a669cd6accf6fa29dc1034ce03d9dae53d6ce117bb86b432bf040fb53230b612c6e9a325e58acc8ebb600f760a8d9d6a383ce751fd6ed

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Windows\WinSxS\wow64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_046b779f2003c415\WalletBackgroundServiceProxy.dll

MD5 1097d1e58872f3cf58f78730a697ce4b
SHA1 96db4e4763a957b28dd80ec1e43eb27367869b86
SHA256 83ec0be293b19d00eca4ae51f16621753e1d2b11248786b25a1abaae6230bdef
SHA512 b933eac4eaabacc51069a72b24b649b980aea251b1b87270ff4ffea12de9368d5447cdbe748ac7faf2805548b896c8499f9eceeed2f5efd0c684f94360940351

C:\Users\Admin\AppData\Local\Temp\4AEA\C\Windows\WinSxS\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8\Windows.ApplicationModel.Wallet.dll

MD5 02557c141c9e153c2b7987b79a3a2dd7
SHA1 a054761382ee68608b6a3b62b68138dc205f576b
SHA256 207c587e769e2655669bd3ce1d28a00bcac08f023013735f026f65c0e3baa6f4
SHA512 a37e29c115bcb9956b1f8fd2022f2e3966c1fa2a0efa5c2ee2d14bc5c41bfddae0deea4d481a681d13ec58e9dec41e7565f8b4eb1c10f2c44c03e58bdd2792b3