Malware Analysis Report

2024-10-16 05:10

Sample ID 231011-x8ec8agh7v
Target b5b467e9309cbddb4a9ed34a82a36163.exe
SHA256 ff38415bfa7f2db5ba40f26e64ede0676971c441823d2ec2755d644d8905d809
Tags
ammyyadmin phobos rhadamanthys smokeloader backdoor bootkit collection evasion persistence ransomware rat stealer trojan flawedammyy spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ff38415bfa7f2db5ba40f26e64ede0676971c441823d2ec2755d644d8905d809

Threat Level: Known bad

The file b5b467e9309cbddb4a9ed34a82a36163.exe was found to be: Known bad.

Malicious Activity Summary

ammyyadmin phobos rhadamanthys smokeloader backdoor bootkit collection evasion persistence ransomware rat stealer trojan flawedammyy spyware

Rhadamanthys

AmmyyAdmin payload

Detect rhadamanthys stealer shellcode

Suspicious use of NtCreateUserProcessOtherParentProcess

Ammyy Admin

SmokeLoader

Phobos

FlawedAmmyy RAT

Modifies boot configuration data using bcdedit

Renames multiple (373) files with added filename extension

Deletes shadow copies

Renames multiple (58) files with added filename extension

Modifies Windows Firewall

Downloads MZ/PE file

Deletes backup catalog

Loads dropped DLL

Checks computer location settings

Drops startup file

Reads user/profile data of web browsers

Deletes itself

Executes dropped EXE

Writes to the Master Boot Record (MBR)

Accesses Microsoft Outlook profiles

Adds Run key to start application

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Suspicious behavior: EnumeratesProcesses

outlook_office_path

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Interacts with shadow copies

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Suspicious use of UnmapMainImage

Checks processor information in registry

Checks SCSI registry key(s)

Uses Volume Shadow Copy service COM API

outlook_win_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-11 19:31

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-11 19:31

Reported

2023-10-11 19:34

Platform

win7-20230831-en

Max time kernel

150s

Max time network

155s

Command Line

C:\Windows\Explorer.EXE

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3008 created 1252 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Renames multiple (58) files with added filename extension

ransomware

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\certreq.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\82B7.exe C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\82B7 = "C:\\Users\\Admin\\AppData\\Local\\82B7.exe" C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\82B7 = "C:\\Users\\Admin\\AppData\\Local\\82B7.exe" C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3185155662-718608226-894467740-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3185155662-718608226-894467740-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\DA39.tmp\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\is.txt.id[25BFF481-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.id[25BFF481-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.id[25BFF481-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\7-Zip\History.txt C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msado15.dll C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\msdaprst.dll C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.id[25BFF481-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.id[25BFF481-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.id[25BFF481-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.id[25BFF481-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jni.h C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.id[25BFF481-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File created C:\Program Files\7-Zip\Lang\tt.txt.id[25BFF481-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.id[25BFF481-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\handler.reg C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.id[25BFF481-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hi.txt C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.id[25BFF481-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File created C:\Program Files\7-Zip\Lang\lt.txt.id[25BFF481-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.id[25BFF481-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.id[25BFF481-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.bat C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak.id[25BFF481-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\84F9.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82B7.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DA39.tmp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1692 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
PID 1692 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
PID 1692 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
PID 1692 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
PID 1692 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
PID 1692 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
PID 1692 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
PID 1692 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
PID 1692 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
PID 3008 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Windows\system32\certreq.exe
PID 3008 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Windows\system32\certreq.exe
PID 3008 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Windows\system32\certreq.exe
PID 3008 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Windows\system32\certreq.exe
PID 3008 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Windows\system32\certreq.exe
PID 3008 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Windows\system32\certreq.exe
PID 328 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 328 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe
PID 2472 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe
PID 2472 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe
PID 2472 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe
PID 2472 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe
PID 2472 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe
PID 2472 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe
PID 2472 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe
PID 1252 wrote to memory of 2704 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\82B7.exe
PID 1252 wrote to memory of 2704 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\82B7.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe

"C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe"

C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe

C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe

"C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe"

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

"C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe"

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe

C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

C:\Users\Admin\AppData\Local\Temp\82B7.exe

C:\Users\Admin\AppData\Local\Temp\82B7.exe

C:\Users\Admin\AppData\Local\Temp\82B7.exe

C:\Users\Admin\AppData\Local\Temp\82B7.exe

C:\Users\Admin\AppData\Local\Temp\84F9.exe

C:\Users\Admin\AppData\Local\Temp\84F9.exe

C:\Users\Admin\AppData\Local\Temp\82B7.exe

"C:\Users\Admin\AppData\Local\Temp\82B7.exe"

C:\Users\Admin\AppData\Local\Temp\82B7.exe

C:\Users\Admin\AppData\Local\Temp\82B7.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\DA39.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\DA39.tmp\svchost.exe -debug

C:\Windows\SysWOW64\ctfmon.exe

ctfmon.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 xemtex534.xyz udp
DE 45.131.66.222:80 xemtex534.xyz tcp
US 8.8.8.8:53 files.catbox.moe udp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 shorturl.at udp
US 104.26.8.129:443 shorturl.at tcp
US 104.26.8.129:443 shorturl.at tcp
US 104.26.8.129:443 shorturl.at tcp
US 104.26.8.129:443 shorturl.at tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp

Files

memory/1692-0-0x0000000073FD0000-0x00000000746BE000-memory.dmp

memory/1692-1-0x0000000000FD0000-0x000000000104A000-memory.dmp

memory/1692-2-0x0000000000A80000-0x0000000000AF8000-memory.dmp

memory/1692-3-0x0000000000F80000-0x0000000000FC0000-memory.dmp

memory/1692-4-0x0000000000CA0000-0x0000000000D08000-memory.dmp

memory/1692-5-0x0000000000F20000-0x0000000000F6C000-memory.dmp

memory/3008-6-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3008-9-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3008-8-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3008-12-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1692-14-0x0000000073FD0000-0x00000000746BE000-memory.dmp

memory/3008-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3008-7-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3008-15-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3008-16-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3008-17-0x0000000000140000-0x0000000000147000-memory.dmp

memory/3008-18-0x0000000002450000-0x0000000002850000-memory.dmp

memory/3008-19-0x0000000002450000-0x0000000002850000-memory.dmp

memory/3008-20-0x0000000002450000-0x0000000002850000-memory.dmp

memory/3008-21-0x0000000002450000-0x0000000002850000-memory.dmp

memory/2640-22-0x0000000000060000-0x0000000000063000-memory.dmp

memory/3008-23-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3008-24-0x0000000000270000-0x00000000002A6000-memory.dmp

memory/3008-30-0x0000000000270000-0x00000000002A6000-memory.dmp

memory/3008-31-0x0000000002450000-0x0000000002850000-memory.dmp

memory/3008-32-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3008-33-0x0000000002450000-0x0000000002850000-memory.dmp

memory/2640-34-0x0000000000060000-0x0000000000063000-memory.dmp

memory/2640-35-0x0000000000120000-0x0000000000127000-memory.dmp

memory/2640-36-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-37-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-38-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-39-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-41-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-40-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-44-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-43-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-45-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-46-0x0000000076EE0000-0x0000000077089000-memory.dmp

memory/2640-47-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-48-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-49-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-50-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-51-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2640-52-0x0000000076EE0000-0x0000000077089000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe

MD5 ecfe62777946dfed18d22fc8b2015a37
SHA1 ec602fc687056f285587b1182fa9777bbf50ab63
SHA256 4911e4611c08d1a54bbe1a3a7d8d801e468968825ed639ed22880fc7e1b0ae7a
SHA512 05657c0add30a2616042f87c0ea91d7faedf69b4e9bd9ff693bc7a1f854c8ab09a423d19ff165dfa9208e14bbfa2dbf7f468f3fce970d6aaa3cfa9fc76b0374b

C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe

MD5 ecfe62777946dfed18d22fc8b2015a37
SHA1 ec602fc687056f285587b1182fa9777bbf50ab63
SHA256 4911e4611c08d1a54bbe1a3a7d8d801e468968825ed639ed22880fc7e1b0ae7a
SHA512 05657c0add30a2616042f87c0ea91d7faedf69b4e9bd9ff693bc7a1f854c8ab09a423d19ff165dfa9208e14bbfa2dbf7f468f3fce970d6aaa3cfa9fc76b0374b

memory/2472-57-0x0000000001200000-0x000000000128C000-memory.dmp

memory/2472-58-0x00000000738E0000-0x0000000073FCE000-memory.dmp

memory/328-62-0x0000000001200000-0x0000000001240000-memory.dmp

memory/328-63-0x0000000000410000-0x000000000044E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/2472-60-0x0000000000520000-0x0000000000564000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/328-65-0x0000000000660000-0x000000000068C000-memory.dmp

memory/328-64-0x00000000738E0000-0x0000000073FCE000-memory.dmp

memory/2472-67-0x00000000049D0000-0x0000000004A10000-memory.dmp

memory/2472-66-0x0000000000740000-0x0000000000772000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/328-78-0x00000000738E0000-0x0000000073FCE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/1964-80-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1964-83-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\J[HgU7evs.exe

MD5 ecfe62777946dfed18d22fc8b2015a37
SHA1 ec602fc687056f285587b1182fa9777bbf50ab63
SHA256 4911e4611c08d1a54bbe1a3a7d8d801e468968825ed639ed22880fc7e1b0ae7a
SHA512 05657c0add30a2616042f87c0ea91d7faedf69b4e9bd9ff693bc7a1f854c8ab09a423d19ff165dfa9208e14bbfa2dbf7f468f3fce970d6aaa3cfa9fc76b0374b

memory/1964-85-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2472-86-0x00000000738E0000-0x0000000073FCE000-memory.dmp

memory/1964-81-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1964-79-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\U6V3X18%iF.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/2640-87-0x0000000000120000-0x0000000000122000-memory.dmp

memory/2640-88-0x0000000076EE0000-0x0000000077089000-memory.dmp

memory/1964-90-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1252-89-0x0000000002B00000-0x0000000002B16000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\82B7.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

C:\Users\Admin\AppData\Local\Temp\82B7.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/2704-104-0x00000000012A0000-0x0000000001310000-memory.dmp

memory/2704-106-0x00000000002F0000-0x0000000000336000-memory.dmp

memory/2704-105-0x0000000073FD0000-0x00000000746BE000-memory.dmp

memory/2704-107-0x0000000000290000-0x00000000002D0000-memory.dmp

memory/2704-108-0x0000000000830000-0x0000000000864000-memory.dmp

\Users\Admin\AppData\Local\Temp\82B7.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/1560-112-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1560-111-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1560-114-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1560-116-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1560-115-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1560-119-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2368-128-0x00000000000B0000-0x000000000012C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\82B7.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/1560-129-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\84F9.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\84F9.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/1560-125-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2704-122-0x0000000073FD0000-0x00000000746BE000-memory.dmp

memory/1560-117-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1560-110-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2368-130-0x0000000073FD0000-0x00000000746BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\82B7.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/2452-132-0x0000000073FD0000-0x00000000746BE000-memory.dmp

memory/2452-133-0x0000000000AE0000-0x0000000000B20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\82B7.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/2452-152-0x0000000073FD0000-0x00000000746BE000-memory.dmp

memory/2112-154-0x0000000000401000-0x000000000040A000-memory.dmp

\Users\Admin\AppData\Local\Temp\82B7.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/2368-156-0x0000000000660000-0x00000000006A0000-memory.dmp

memory/2368-157-0x00000000048F0000-0x0000000004932000-memory.dmp

memory/1968-160-0x0000000000060000-0x000000000006C000-memory.dmp

memory/1968-159-0x0000000000070000-0x0000000000077000-memory.dmp

memory/2868-161-0x0000000000160000-0x00000000001D5000-memory.dmp

memory/2868-164-0x0000000000080000-0x00000000000EB000-memory.dmp

memory/2368-163-0x0000000073FD0000-0x00000000746BE000-memory.dmp

memory/1800-180-0x0000000000080000-0x0000000000089000-memory.dmp

memory/1800-179-0x0000000000090000-0x0000000000094000-memory.dmp

memory/2868-177-0x0000000000080000-0x00000000000EB000-memory.dmp

memory/1588-183-0x0000000000080000-0x000000000008B000-memory.dmp

memory/1588-181-0x0000000000090000-0x000000000009A000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82B7.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/2088-213-0x0000000000090000-0x0000000000097000-memory.dmp

memory/2368-216-0x0000000000660000-0x00000000006A0000-memory.dmp

memory/2088-217-0x0000000000080000-0x000000000008B000-memory.dmp

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.id[25BFF481-3483].[[email protected]].8base

MD5 fdea753b58161b599cc6acc188a3895f
SHA1 d267fa5d92e997af45f7655d716bd263df85bd4e
SHA256 466d5c25e2f0689ae1a6b9ccc4223f48af9a6209f8dece9ac1382200b15f3316
SHA512 f6e5965465a0783f1125c877116adeb388f4446b0b9df03be6e56baf7f5cc032a4ee2770666e69400f272e92c305afeac27c8466d66d06da0f25eb1d14743b59

memory/3032-244-0x0000000000070000-0x0000000000079000-memory.dmp

memory/3032-246-0x0000000000060000-0x000000000006F000-memory.dmp

memory/3060-258-0x0000000000090000-0x0000000000095000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DA39.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

\Users\Admin\AppData\Local\Temp\DA39.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\DA39.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

\Users\Admin\AppData\Local\Temp\DA39.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\DA39.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-11 19:31

Reported

2023-10-11 19:34

Platform

win10v2004-20230915-en

Max time kernel

152s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe"

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

FlawedAmmyy RAT

trojan flawedammyy

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4904 created 3128 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (373) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\svchost.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\139E.exe C:\Users\Admin\AppData\Local\Temp\139E.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\139E = "C:\\Users\\Admin\\AppData\\Local\\139E.exe" C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\139E = "C:\\Users\\Admin\\AppData\\Local\\139E.exe" C:\Users\Admin\AppData\Local\Temp\139E.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1141987721-3945596982-3297311814-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1141987721-3945596982-3297311814-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\139E.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookLargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-20_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-40_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\SATIN.INF C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\mmsogdiplusim.dll C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_zh_HK.properties C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\sd\jamendo.luac.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-48.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubStoreLogo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-default_32.svg.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgePackages.h.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchStoreLogo.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-24.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-default_32.svg C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\PREVIEW.GIF.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MeetingJoinAxOC.dll C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeBadge.scale-150.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\mlib_image.dll.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-150_contrast-white.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailSmallTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\star_full.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\3difr.x3d.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vreg\dcfmui.msi.16.en-us.vreg.dat C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\kn-IN\View3d\3DViewerProductDescription-universal.xml C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailWideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-32_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\SmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxSmallTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\Microsoft.Services.Store.Engagement.dll C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-32.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-20_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_joined.gif.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.ini C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxMediumTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-focus.svg.id[805E56EE-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupMedTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\139E.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1544.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\139E.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\svchost.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3364 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
PID 3364 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
PID 3364 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
PID 3364 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
PID 3364 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
PID 3364 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
PID 3364 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
PID 3364 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe
PID 4904 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Windows\system32\certreq.exe
PID 4904 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Windows\system32\certreq.exe
PID 4904 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Windows\system32\certreq.exe
PID 4904 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe C:\Windows\system32\certreq.exe
PID 2456 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 4596 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 4596 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 4596 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 2456 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe
PID 4368 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
PID 4368 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
PID 4368 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
PID 4368 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
PID 4368 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
PID 4368 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
PID 4368 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
PID 4368 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
PID 4368 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe
PID 3128 wrote to memory of 3060 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\139E.exe
PID 3128 wrote to memory of 3060 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\139E.exe
PID 3128 wrote to memory of 3060 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\139E.exe
PID 3128 wrote to memory of 4700 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\1544.exe
PID 3128 wrote to memory of 4700 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\1544.exe
PID 3128 wrote to memory of 4700 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\1544.exe
PID 3060 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\139E.exe C:\Users\Admin\AppData\Local\Temp\139E.exe
PID 3060 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\139E.exe C:\Users\Admin\AppData\Local\Temp\139E.exe
PID 3060 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\139E.exe C:\Users\Admin\AppData\Local\Temp\139E.exe
PID 3060 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\139E.exe C:\Users\Admin\AppData\Local\Temp\139E.exe
PID 3060 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\139E.exe C:\Users\Admin\AppData\Local\Temp\139E.exe
PID 3060 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\139E.exe C:\Users\Admin\AppData\Local\Temp\139E.exe
PID 3060 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\139E.exe C:\Users\Admin\AppData\Local\Temp\139E.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe

"C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe

C:\Users\Admin\AppData\Local\Temp\b5b467e9309cbddb4a9ed34a82a36163.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

"C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe"

C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe

"C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe"

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe

C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe

C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe

C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

C:\Users\Admin\AppData\Local\Temp\139E.exe

C:\Users\Admin\AppData\Local\Temp\139E.exe

C:\Users\Admin\AppData\Local\Temp\1544.exe

C:\Users\Admin\AppData\Local\Temp\1544.exe

C:\Users\Admin\AppData\Local\Temp\139E.exe

C:\Users\Admin\AppData\Local\Temp\139E.exe

C:\Users\Admin\AppData\Local\Temp\139E.exe

"C:\Users\Admin\AppData\Local\Temp\139E.exe"

C:\Users\Admin\AppData\Local\Temp\139E.exe

C:\Users\Admin\AppData\Local\Temp\139E.exe

C:\Users\Admin\AppData\Local\Temp\1544.exe

"C:\Users\Admin\AppData\Local\Temp\1544.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\svchost.exe -debug

C:\Windows\SYSTEM32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\aa_nts.dll",run

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 126.23.238.8.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 61.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 126.22.238.8.in-addr.arpa udp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 xemtex534.xyz udp
DE 45.131.66.222:80 xemtex534.xyz tcp
US 8.8.8.8:53 120.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 222.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 files.catbox.moe udp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 35.20.181.108.in-addr.arpa udp
US 8.8.8.8:53 shorturl.at udp
US 172.67.69.88:443 shorturl.at tcp
US 8.8.8.8:53 www.shorturl.at udp
US 104.26.8.129:443 www.shorturl.at tcp
US 8.8.8.8:53 www.dropbox.com udp
US 162.125.8.18:443 www.dropbox.com tcp
US 8.8.8.8:53 88.69.67.172.in-addr.arpa udp
US 8.8.8.8:53 129.8.26.104.in-addr.arpa udp
US 8.8.8.8:53 18.8.125.162.in-addr.arpa udp
US 172.67.69.88:443 www.shorturl.at tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.242:443 tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 226.162.46.104.in-addr.arpa udp
US 8.8.8.8:53 148.129.42.188.in-addr.arpa udp
US 8.8.8.8:53 242.104.243.136.in-addr.arpa udp
US 8.8.8.8:53 www.ammyy.com udp
DE 136.243.18.118:80 www.ammyy.com tcp
DE 136.243.18.118:443 www.ammyy.com tcp
US 8.8.8.8:53 118.18.243.136.in-addr.arpa udp
US 8.8.8.8:53 147.174.42.23.in-addr.arpa udp
US 8.8.8.8:53 9.175.53.84.in-addr.arpa udp

Files

memory/3364-0-0x0000000000EC0000-0x0000000000F3A000-memory.dmp

memory/3364-1-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/3364-2-0x00000000058A0000-0x0000000005918000-memory.dmp

memory/3364-3-0x0000000005820000-0x0000000005830000-memory.dmp

memory/3364-4-0x0000000005950000-0x00000000059B8000-memory.dmp

memory/3364-5-0x00000000059C0000-0x0000000005A0C000-memory.dmp

memory/3364-6-0x0000000006020000-0x00000000065C4000-memory.dmp

memory/4904-7-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4904-10-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4904-12-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3364-11-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/4904-13-0x00000000015C0000-0x00000000015C7000-memory.dmp

memory/4904-15-0x00000000031D0000-0x00000000035D0000-memory.dmp

memory/4904-14-0x00000000031D0000-0x00000000035D0000-memory.dmp

memory/4904-16-0x00000000031D0000-0x00000000035D0000-memory.dmp

memory/4904-17-0x00000000031D0000-0x00000000035D0000-memory.dmp

memory/4760-18-0x000001DD095E0000-0x000001DD095E3000-memory.dmp

memory/4904-19-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4904-20-0x0000000003F90000-0x0000000003FC6000-memory.dmp

memory/4904-26-0x0000000003F90000-0x0000000003FC6000-memory.dmp

memory/4904-27-0x00000000031D0000-0x00000000035D0000-memory.dmp

memory/4904-28-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4904-29-0x00000000031D0000-0x00000000035D0000-memory.dmp

memory/4760-31-0x000001DD09880000-0x000001DD09887000-memory.dmp

memory/4760-30-0x000001DD095E0000-0x000001DD095E3000-memory.dmp

memory/4760-32-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

memory/4760-34-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

memory/4760-35-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

memory/4760-36-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

memory/4760-38-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

memory/4760-41-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

memory/4760-42-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

memory/4760-43-0x00007FFB9E530000-0x00007FFB9E725000-memory.dmp

memory/4760-40-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

memory/4760-33-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

memory/4760-44-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

memory/4760-45-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

memory/4760-46-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

memory/4760-47-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

memory/4760-48-0x00007FF402980000-0x00007FF402AAF000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/2456-52-0x0000000000BB0000-0x0000000000BF0000-memory.dmp

memory/2456-54-0x00000000053F0000-0x000000000542E000-memory.dmp

memory/2456-55-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/2456-57-0x0000000005470000-0x000000000549C000-memory.dmp

memory/2456-58-0x0000000005560000-0x0000000005570000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe

MD5 ecfe62777946dfed18d22fc8b2015a37
SHA1 ec602fc687056f285587b1182fa9777bbf50ab63
SHA256 4911e4611c08d1a54bbe1a3a7d8d801e468968825ed639ed22880fc7e1b0ae7a
SHA512 05657c0add30a2616042f87c0ea91d7faedf69b4e9bd9ff693bc7a1f854c8ab09a423d19ff165dfa9208e14bbfa2dbf7f468f3fce970d6aaa3cfa9fc76b0374b

C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe

MD5 ecfe62777946dfed18d22fc8b2015a37
SHA1 ec602fc687056f285587b1182fa9777bbf50ab63
SHA256 4911e4611c08d1a54bbe1a3a7d8d801e468968825ed639ed22880fc7e1b0ae7a
SHA512 05657c0add30a2616042f87c0ea91d7faedf69b4e9bd9ff693bc7a1f854c8ab09a423d19ff165dfa9208e14bbfa2dbf7f468f3fce970d6aaa3cfa9fc76b0374b

memory/4368-61-0x00000000005A0000-0x000000000062C000-memory.dmp

memory/4368-63-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/4368-64-0x0000000004E10000-0x0000000004E20000-memory.dmp

memory/4368-65-0x0000000004EC0000-0x0000000004EF2000-memory.dmp

memory/4368-62-0x0000000004DD0000-0x0000000004E14000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/2456-77-0x0000000074E20000-0x00000000755D0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe

MD5 ecfe62777946dfed18d22fc8b2015a37
SHA1 ec602fc687056f285587b1182fa9777bbf50ab63
SHA256 4911e4611c08d1a54bbe1a3a7d8d801e468968825ed639ed22880fc7e1b0ae7a
SHA512 05657c0add30a2616042f87c0ea91d7faedf69b4e9bd9ff693bc7a1f854c8ab09a423d19ff165dfa9208e14bbfa2dbf7f468f3fce970d6aaa3cfa9fc76b0374b

memory/1156-82-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1156-79-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4368-83-0x0000000074E20000-0x00000000755D0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\m_Rb%.exe

MD5 ecfe62777946dfed18d22fc8b2015a37
SHA1 ec602fc687056f285587b1182fa9777bbf50ab63
SHA256 4911e4611c08d1a54bbe1a3a7d8d801e468968825ed639ed22880fc7e1b0ae7a
SHA512 05657c0add30a2616042f87c0ea91d7faedf69b4e9bd9ff693bc7a1f854c8ab09a423d19ff165dfa9208e14bbfa2dbf7f468f3fce970d6aaa3cfa9fc76b0374b

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\V]5jPPdpdb.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/4760-56-0x00007FFB9E530000-0x00007FFB9E725000-memory.dmp

memory/4760-84-0x000001DD09880000-0x000001DD09885000-memory.dmp

memory/4760-85-0x00007FFB9E530000-0x00007FFB9E725000-memory.dmp

memory/3128-86-0x0000000002CA0000-0x0000000002CB6000-memory.dmp

memory/1156-87-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\139E.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

C:\Users\Admin\AppData\Local\Temp\139E.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/3060-100-0x0000000000010000-0x0000000000080000-memory.dmp

memory/3060-101-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/3060-102-0x00000000048C0000-0x0000000004906000-memory.dmp

memory/3060-103-0x0000000004A40000-0x0000000004A50000-memory.dmp

memory/3060-104-0x0000000004900000-0x0000000004934000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1544.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\1544.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/4700-110-0x0000000000410000-0x000000000048C000-memory.dmp

memory/4700-109-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/4436-111-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\139E.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/4700-112-0x0000000005860000-0x00000000058F2000-memory.dmp

memory/4700-116-0x0000000005900000-0x000000000599C000-memory.dmp

memory/4436-117-0x0000000000400000-0x0000000000413000-memory.dmp

memory/3060-118-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/4436-119-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\139E.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\139E.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

memory/2736-122-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/2736-124-0x0000000004F10000-0x0000000004F20000-memory.dmp

memory/4700-123-0x0000000006730000-0x0000000006772000-memory.dmp

memory/4700-125-0x0000000006720000-0x0000000006730000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\139E.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/1064-130-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2736-131-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/4700-132-0x0000000006AE0000-0x0000000006AEA000-memory.dmp

memory/4700-133-0x0000000006720000-0x0000000006730000-memory.dmp

memory/4700-134-0x0000000007C60000-0x0000000007C7A000-memory.dmp

memory/4700-135-0x0000000007C40000-0x0000000007C46000-memory.dmp

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\139E.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/4436-146-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4436-147-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4436-148-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4436-150-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4436-168-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4436-153-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4436-218-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4436-223-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4436-222-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4436-221-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4436-169-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4700-319-0x0000000074E20000-0x00000000755D0000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[805E56EE-3483].[[email protected]].8base

MD5 c25964a94f7f00cd6834e168823dcdf4
SHA1 b50653f8088b199467a579bfe9f9e3f35668cce7
SHA256 036c17e7cfdbb6ad285240c757c9a05776e7fb366994f2888033cfda528b4fed
SHA512 bec58b7dacf9a88872fb37e7cef03639669bf0d3590309d35dd6514fbf307684ca83fc0e7907263bffe631cc700540425e8ac42e7527fb89f197e328420433c1

memory/4436-393-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4700-488-0x0000000006720000-0x0000000006730000-memory.dmp

memory/4700-795-0x0000000006720000-0x0000000006730000-memory.dmp

memory/3128-1760-0x0000000007070000-0x0000000007072000-memory.dmp

memory/3128-1749-0x00000000070B0000-0x00000000070C0000-memory.dmp

memory/3128-1771-0x00000000070B0000-0x00000000070C0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x00o19f5.default-release\cookies.sqlite.id[805E56EE-3483].[[email protected]].8base

MD5 a03719011c7f7d4d176ed5fb73c85c3c
SHA1 d6a00d0bc32ac61a6def8ba8d37b68ccd4f27db0
SHA256 beb7f0db5fb24252c5edeec8bd914984dd13e68eae61ffb527093752bd3a7e88
SHA512 928013e3a93b7ce1ac0e99fbf58e4e92ab6e0ac61de16203ea629513ff5e25bfe792c4c64cb58060862f63933a14da323731bc3c00ee90ab9fc71a981c07e6ea

C:\Users\Admin\AppData\Local\Temp\1544.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\DCBA.tmp\aa_nts.msg

MD5 3f05819f995b4dafa1b5d55ce8d1f411
SHA1 404449b79a16bfc4f64f2fd55cd73d5d27a85d71
SHA256 7e0bf0cbd06a087500a9c3b50254df3a8a2c2980921ab6a62ab1121941c80fc0
SHA512 34abb7df8b3a68e1649ff0d2762576a4d4e65da548e74b1aa65c2b82c1b89f90d053ecddac67c614ca6084dc5b2cb552949250fb70f49b536f1bcb0057717026