Malware Analysis Report

2024-10-16 05:10

Sample ID 231011-x8zzxsha2x
Target 534e8c1d3d71f8736793b80048c3dbdd.exe
SHA256 70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade
Tags
ammyyadmin flawedammyy phobos rhadamanthys smokeloader backdoor bootkit collection evasion persistence ransomware rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

70debce3a545cacca8b0bdb6008945852084b36e9160424fb63479c2991dcade

Threat Level: Known bad

The file 534e8c1d3d71f8736793b80048c3dbdd.exe was found to be: Known bad.

Malicious Activity Summary

ammyyadmin flawedammyy phobos rhadamanthys smokeloader backdoor bootkit collection evasion persistence ransomware rat spyware stealer trojan

SmokeLoader

Detect rhadamanthys stealer shellcode

FlawedAmmyy RAT

Rhadamanthys

AmmyyAdmin payload

Phobos

Suspicious use of NtCreateUserProcessOtherParentProcess

Ammyy Admin

Renames multiple (91) files with added filename extension

Deletes shadow copies

Modifies boot configuration data using bcdedit

Renames multiple (86) files with added filename extension

Deletes backup catalog

Downloads MZ/PE file

Modifies Windows Firewall

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Deletes itself

Drops startup file

Reads user/profile data of web browsers

Writes to the Master Boot Record (MBR)

Accesses Microsoft Outlook profiles

Drops desktop.ini file(s)

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Interacts with shadow copies

outlook_office_path

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies system certificate store

Checks processor information in registry

Checks SCSI registry key(s)

Suspicious behavior: MapViewOfSection

Suspicious use of UnmapMainImage

outlook_win_path

Uses Volume Shadow Copy service COM API

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-11 19:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-11 19:32

Reported

2023-10-11 19:35

Platform

win7-20230831-en

Max time kernel

151s

Max time network

169s

Command Line

C:\Windows\Explorer.EXE

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

FlawedAmmyy RAT

trojan flawedammyy

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2776 created 1216 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (86) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\930C.tmp\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\certreq.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\D578.exe C:\Users\Admin\AppData\Local\Temp\D578.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\zj%6EfCu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\zj%6EfCu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D9FB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D9FB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930C.tmp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D9FB.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\D578 = "C:\\Users\\Admin\\AppData\\Local\\D578.exe" C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Windows\CurrentVersion\Run\D578 = "C:\\Users\\Admin\\AppData\\Local\\D578.exe" C:\Users\Admin\AppData\Local\Temp\D578.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3849525425-30183055-657688904-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3849525425-30183055-657688904-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\D578.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\930C.tmp\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jre7\bin\jfr.dll.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Internet Explorer\sqmapi.dll C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-dialogs.jar.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_ja.jar.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_zh_CN.jar.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler.xml.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Internet Explorer\en-US\eula.rtf C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-tabcontrol.xml C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.common_2.10.1.v20140901-1043.jar C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\msaddsr.dll C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.services_1.2.1.v20140808-1251.jar C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_zh_4.4.0.v20140623020002.jar.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mr.txt C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ar.txt C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion.id[588A7ED8-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\D578.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\zj%6EfCu.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\zj%6EfCu.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\zj%6EfCu.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\930C.tmp\svchost.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\930C.tmp\svchost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\930C.tmp\svchost.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\930C.tmp\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\zj%6EfCu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\zj%6EfCu.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\zj%6EfCu.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\D9FB.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\D578.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\930C.tmp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2700 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2700 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 2776 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Windows\system32\certreq.exe
PID 2776 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Windows\system32\certreq.exe
PID 2776 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Windows\system32\certreq.exe
PID 2776 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Windows\system32\certreq.exe
PID 2776 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Windows\system32\certreq.exe
PID 2776 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Windows\system32\certreq.exe
PID 1960 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe
PID 1960 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe

"C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe"

C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe

C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe

C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe

C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe

C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe

C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe

C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe

C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

"C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe"

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\zj%6EfCu.exe

"C:\Users\Admin\AppData\Local\Microsoft\zj%6EfCu.exe"

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\zj%6EfCu.exe

C:\Users\Admin\AppData\Local\Microsoft\zj%6EfCu.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

C:\Users\Admin\AppData\Local\Temp\D578.exe

C:\Users\Admin\AppData\Local\Temp\D578.exe

C:\Users\Admin\AppData\Local\Temp\D578.exe

C:\Users\Admin\AppData\Local\Temp\D578.exe

C:\Users\Admin\AppData\Local\Temp\D578.exe

"C:\Users\Admin\AppData\Local\Temp\D578.exe"

C:\Users\Admin\AppData\Local\Temp\D9FB.exe

C:\Users\Admin\AppData\Local\Temp\D9FB.exe

C:\Users\Admin\AppData\Local\Temp\D578.exe

C:\Users\Admin\AppData\Local\Temp\D578.exe

C:\Users\Admin\AppData\Local\Temp\D578.exe

C:\Users\Admin\AppData\Local\Temp\D578.exe

C:\Users\Admin\AppData\Local\Temp\D578.exe

C:\Users\Admin\AppData\Local\Temp\D578.exe

C:\Users\Admin\AppData\Local\Temp\D578.exe

C:\Users\Admin\AppData\Local\Temp\D578.exe

C:\Users\Admin\AppData\Local\Temp\D578.exe

C:\Users\Admin\AppData\Local\Temp\D578.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Users\Admin\AppData\Local\Temp\D9FB.exe

"C:\Users\Admin\AppData\Local\Temp\D9FB.exe"

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\D9FB.exe

"C:\Users\Admin\AppData\Local\Temp\D9FB.exe"

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\930C.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\930C.tmp\svchost.exe -debug

C:\Windows\SysWOW64\ctfmon.exe

ctfmon.exe

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\930C.tmp\aa_nts.dll",run

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 xemtex534.xyz udp
DE 45.131.66.222:80 xemtex534.xyz tcp
US 8.8.8.8:53 files.catbox.moe udp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 shorturl.at udp
US 104.26.9.129:443 shorturl.at tcp
US 104.26.9.129:443 shorturl.at tcp
US 104.26.9.129:443 shorturl.at tcp
US 104.26.9.129:443 shorturl.at tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.242:443 tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 www.ammyy.com udp
DE 136.243.18.118:80 www.ammyy.com tcp
DE 136.243.18.118:443 www.ammyy.com tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 88.221.25.153:80 apps.identrust.com tcp

Files

memory/2700-0-0x0000000000200000-0x00000000003EA000-memory.dmp

memory/2700-1-0x00000000747E0000-0x0000000074ECE000-memory.dmp

memory/2700-2-0x00000000049E0000-0x0000000004A20000-memory.dmp

memory/2700-3-0x0000000001F60000-0x0000000001FDC000-memory.dmp

memory/2700-4-0x0000000004360000-0x00000000043D8000-memory.dmp

memory/2700-5-0x0000000004940000-0x00000000049A8000-memory.dmp

memory/2700-6-0x00000000007A0000-0x00000000007EC000-memory.dmp

memory/2776-9-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2776-7-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2776-11-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2776-13-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2776-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2776-17-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2700-19-0x00000000747E0000-0x0000000074ECE000-memory.dmp

memory/2776-20-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2776-21-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2776-22-0x0000000000150000-0x0000000000157000-memory.dmp

memory/2776-23-0x00000000022E0000-0x00000000026E0000-memory.dmp

memory/2776-25-0x00000000022E0000-0x00000000026E0000-memory.dmp

memory/2776-24-0x00000000022E0000-0x00000000026E0000-memory.dmp

memory/2776-26-0x00000000022E0000-0x00000000026E0000-memory.dmp

memory/2584-27-0x0000000000060000-0x0000000000063000-memory.dmp

memory/2776-28-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2776-29-0x00000000022E0000-0x00000000026E0000-memory.dmp

memory/2776-30-0x0000000000180000-0x00000000001B6000-memory.dmp

memory/2776-36-0x00000000022E0000-0x00000000026E0000-memory.dmp

memory/2776-38-0x00000000022E0000-0x00000000026E0000-memory.dmp

memory/2776-37-0x0000000000180000-0x00000000001B6000-memory.dmp

memory/2776-39-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2776-40-0x00000000022E0000-0x00000000026E0000-memory.dmp

memory/2584-41-0x0000000000060000-0x0000000000063000-memory.dmp

memory/2584-42-0x0000000000120000-0x0000000000127000-memory.dmp

memory/2584-43-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2584-44-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2584-45-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2584-46-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2584-47-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2584-49-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2584-51-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2584-52-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2584-53-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2584-54-0x00000000775E0000-0x0000000077789000-memory.dmp

memory/2584-55-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2584-56-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2584-57-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2584-58-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2584-59-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/2584-64-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/1960-63-0x0000000000DD0000-0x0000000000E10000-memory.dmp

memory/1960-65-0x00000000001E0000-0x000000000021E000-memory.dmp

memory/1960-66-0x0000000074660000-0x0000000074D4E000-memory.dmp

memory/2584-68-0x00000000775E0000-0x0000000077789000-memory.dmp

memory/1960-67-0x00000000002C0000-0x00000000002EC000-memory.dmp

memory/1960-69-0x00000000049B0000-0x00000000049F0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/1960-81-0x0000000074660000-0x0000000074D4E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\zj%6EfCu.exe

MD5 ecfe62777946dfed18d22fc8b2015a37
SHA1 ec602fc687056f285587b1182fa9777bbf50ab63
SHA256 4911e4611c08d1a54bbe1a3a7d8d801e468968825ed639ed22880fc7e1b0ae7a
SHA512 05657c0add30a2616042f87c0ea91d7faedf69b4e9bd9ff693bc7a1f854c8ab09a423d19ff165dfa9208e14bbfa2dbf7f468f3fce970d6aaa3cfa9fc76b0374b

memory/368-84-0x0000000000F00000-0x0000000000F8C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\zj%6EfCu.exe

MD5 ecfe62777946dfed18d22fc8b2015a37
SHA1 ec602fc687056f285587b1182fa9777bbf50ab63
SHA256 4911e4611c08d1a54bbe1a3a7d8d801e468968825ed639ed22880fc7e1b0ae7a
SHA512 05657c0add30a2616042f87c0ea91d7faedf69b4e9bd9ff693bc7a1f854c8ab09a423d19ff165dfa9208e14bbfa2dbf7f468f3fce970d6aaa3cfa9fc76b0374b

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/368-85-0x0000000074660000-0x0000000074D4E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/368-87-0x0000000000670000-0x00000000006A2000-memory.dmp

memory/368-86-0x0000000000480000-0x00000000004C4000-memory.dmp

memory/368-88-0x0000000000B80000-0x0000000000BC0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/296-89-0x0000000000400000-0x000000000040B000-memory.dmp

memory/296-90-0x0000000000400000-0x000000000040B000-memory.dmp

memory/296-91-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/296-95-0x0000000000400000-0x000000000040B000-memory.dmp

memory/368-96-0x0000000074660000-0x0000000074D4E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\zj%6EfCu.exe

MD5 ecfe62777946dfed18d22fc8b2015a37
SHA1 ec602fc687056f285587b1182fa9777bbf50ab63
SHA256 4911e4611c08d1a54bbe1a3a7d8d801e468968825ed639ed22880fc7e1b0ae7a
SHA512 05657c0add30a2616042f87c0ea91d7faedf69b4e9bd9ff693bc7a1f854c8ab09a423d19ff165dfa9208e14bbfa2dbf7f468f3fce970d6aaa3cfa9fc76b0374b

memory/296-93-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\YE)OB.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/2584-97-0x0000000000120000-0x0000000000122000-memory.dmp

memory/2584-98-0x00000000775E0000-0x0000000077789000-memory.dmp

memory/296-100-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1216-99-0x0000000002A80000-0x0000000002A96000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D578.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

C:\Users\Admin\AppData\Local\Temp\D578.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/1296-114-0x00000000747E0000-0x0000000074ECE000-memory.dmp

memory/1296-116-0x0000000000330000-0x0000000000376000-memory.dmp

memory/1296-115-0x0000000000A00000-0x0000000000A70000-memory.dmp

memory/1296-118-0x0000000000930000-0x0000000000964000-memory.dmp

memory/1296-117-0x0000000004430000-0x0000000004470000-memory.dmp

\Users\Admin\AppData\Local\Temp\D578.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/2424-120-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2424-122-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2424-124-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2424-126-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2424-128-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2424-130-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2424-132-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2424-134-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1296-137-0x00000000747E0000-0x0000000074ECE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D578.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/2424-139-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D578.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

C:\Users\Admin\AppData\Local\Temp\D9FB.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/1120-146-0x00000000011A0000-0x000000000121C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D9FB.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/1808-149-0x0000000074790000-0x0000000074E7E000-memory.dmp

memory/1808-148-0x0000000000620000-0x0000000000666000-memory.dmp

memory/1808-147-0x0000000000A00000-0x0000000000A70000-memory.dmp

memory/1808-150-0x0000000004630000-0x0000000004670000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D578.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

\Users\Admin\AppData\Local\Temp\D578.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

C:\Users\Admin\AppData\Local\Temp\D578.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

\Users\Admin\AppData\Local\Temp\D578.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

C:\Users\Admin\AppData\Local\Temp\D578.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/1120-153-0x0000000074790000-0x0000000074E7E000-memory.dmp

\Users\Admin\AppData\Local\Temp\D578.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

\Users\Admin\AppData\Local\Temp\D578.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

C:\Users\Admin\AppData\Local\Temp\D578.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

\Users\Admin\AppData\Local\Temp\D578.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/1120-163-0x0000000005740000-0x0000000005780000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D578.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/1808-173-0x0000000074790000-0x0000000074E7E000-memory.dmp

memory/1120-174-0x0000000000490000-0x00000000004D2000-memory.dmp

memory/1388-176-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1012-178-0x00000000004D0000-0x0000000000545000-memory.dmp

memory/1012-180-0x0000000000110000-0x000000000017B000-memory.dmp

memory/1012-193-0x0000000000110000-0x000000000017B000-memory.dmp

memory/2496-195-0x0000000000070000-0x0000000000077000-memory.dmp

memory/2496-196-0x0000000000060000-0x000000000006C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\D578.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/1568-213-0x0000000000060000-0x000000000006C000-memory.dmp

memory/1120-217-0x0000000000EE0000-0x0000000000EFA000-memory.dmp

memory/1568-215-0x00000000000C0000-0x00000000000C9000-memory.dmp

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.id[588A7ED8-3483].[[email protected]].8base

MD5 68f5aaccb6ca6981846070787fbedbfc
SHA1 2921cae3dae9d63a5e6824e2aad8dc0683695548
SHA256 c67d3656835925a463786b2d7d3dacde90809b1143f128d000cd8d48e03d9648
SHA512 3e839e1f5acd87c44e097720addccfb11ec68ffeba16245ef09bf63d0662acdc0b9ca729cdecebd74a77f32c7917015b25a320157e04068f5ad36612f18acd92

memory/1120-254-0x0000000074790000-0x0000000074E7E000-memory.dmp

\Users\Admin\AppData\Local\Temp\D9FB.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

\Users\Admin\AppData\Local\Temp\D9FB.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\D9FB.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

\Users\Admin\AppData\Local\Temp\930C.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

\Users\Admin\AppData\Local\Temp\930C.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\930C.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\930C.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\930C.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\CabAE7A.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\TarAF76.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9ee348f77a5f5827f297c1f75f06f603
SHA1 4bd5d7bfcff4634701ec79f85c14c14052a67dc7
SHA256 0b958dfa38544da9c9cb5e3e26e54a60801d7dd52ef3e12bdd23e0ee49331dd0
SHA512 c1edf8685eea50d90abd85f9ba38adb8fb6562b7cf44cfc7681bf2192b1dd7ca55b70212b9e5790622c42ca9bd71e73b63c277bf9b7ecfd3bc21842d078ece6d

C:\Users\Admin\AppData\Local\Temp\930C.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

\Users\Admin\AppData\Local\Temp\930C.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

\Users\Admin\AppData\Local\Temp\930C.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

\Users\Admin\AppData\Local\Temp\930C.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\930C.tmp\aa_nts.msg

MD5 3f05819f995b4dafa1b5d55ce8d1f411
SHA1 404449b79a16bfc4f64f2fd55cd73d5d27a85d71
SHA256 7e0bf0cbd06a087500a9c3b50254df3a8a2c2980921ab6a62ab1121941c80fc0
SHA512 34abb7df8b3a68e1649ff0d2762576a4d4e65da548e74b1aa65c2b82c1b89f90d053ecddac67c614ca6084dc5b2cb552949250fb70f49b536f1bcb0057717026

\Users\Admin\AppData\Local\Temp\930C.tmp\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\Users\Admin\AppData\Local\Temp\D9FB.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-11 19:32

Reported

2023-10-11 19:36

Platform

win10v2004-20230915-en

Max time kernel

150s

Max time network

156s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3408 created 3152 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (91) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\D1C2.exe C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\D1C2 = "C:\\Users\\Admin\\AppData\\Local\\D1C2.exe" C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\D1C2 = "C:\\Users\\Admin\\AppData\\Local\\D1C2.exe" C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2890696111-2332180956-3312704074-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-2890696111-2332180956-3312704074-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\jvm.dll.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_LinkDrop32x32.gif.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mn.txt C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvm.xml.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\npt.dll C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fr.txt C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ast.txt C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-api-search.xml.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\content-types.properties.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-util-enumerations.jar.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_CopyDrop32x32.gif.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.dll C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nb.txt C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.id[31E588D1-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\D34A.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\D1C2.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4476 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 4476 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 4476 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 4476 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 4476 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 4476 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 4476 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 4476 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 4476 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 4476 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 4476 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe
PID 3408 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Windows\system32\certreq.exe
PID 3408 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Windows\system32\certreq.exe
PID 3408 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Windows\system32\certreq.exe
PID 3408 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe C:\Windows\system32\certreq.exe
PID 3652 wrote to memory of 716 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 716 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 716 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 1752 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe
PID 1752 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe
PID 1752 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe
PID 3652 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 1752 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe
PID 1752 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe
PID 1752 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe
PID 3652 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3652 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe
PID 3152 wrote to memory of 1532 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\D1C2.exe
PID 3152 wrote to memory of 1532 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\D1C2.exe
PID 3152 wrote to memory of 1532 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\D1C2.exe
PID 3152 wrote to memory of 2676 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\D34A.exe
PID 3152 wrote to memory of 2676 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\D34A.exe
PID 3152 wrote to memory of 2676 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\D34A.exe
PID 1532 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\D1C2.exe C:\Users\Admin\AppData\Local\Temp\D1C2.exe
PID 1532 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\D1C2.exe C:\Users\Admin\AppData\Local\Temp\D1C2.exe
PID 1532 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\D1C2.exe C:\Users\Admin\AppData\Local\Temp\D1C2.exe
PID 1532 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\D1C2.exe C:\Users\Admin\AppData\Local\Temp\D1C2.exe
PID 1532 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\D1C2.exe C:\Users\Admin\AppData\Local\Temp\D1C2.exe
PID 1532 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\D1C2.exe C:\Users\Admin\AppData\Local\Temp\D1C2.exe
PID 1532 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\D1C2.exe C:\Users\Admin\AppData\Local\Temp\D1C2.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe

"C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe"

C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe

C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe

C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe

C:\Users\Admin\AppData\Local\Temp\534e8c1d3d71f8736793b80048c3dbdd.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

"C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe"

C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe

"C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe"

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe

C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

C:\Users\Admin\AppData\Local\Temp\D1C2.exe

C:\Users\Admin\AppData\Local\Temp\D1C2.exe

C:\Users\Admin\AppData\Local\Temp\D34A.exe

C:\Users\Admin\AppData\Local\Temp\D34A.exe

C:\Users\Admin\AppData\Local\Temp\D1C2.exe

C:\Users\Admin\AppData\Local\Temp\D1C2.exe

C:\Users\Admin\AppData\Local\Temp\D1C2.exe

"C:\Users\Admin\AppData\Local\Temp\D1C2.exe"

C:\Users\Admin\AppData\Local\Temp\D1C2.exe

C:\Users\Admin\AppData\Local\Temp\D1C2.exe

C:\Users\Admin\AppData\Local\Temp\D34A.exe

"C:\Users\Admin\AppData\Local\Temp\D34A.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Users\Admin\AppData\Local\Temp\D34A.exe

"C:\Users\Admin\AppData\Local\Temp\D34A.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 254.21.238.8.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 25.178.78.104.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 61.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 126.22.238.8.in-addr.arpa udp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 xemtex534.xyz udp
DE 45.131.66.222:80 xemtex534.xyz tcp
US 8.8.8.8:53 120.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 222.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 files.catbox.moe udp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 35.20.181.108.in-addr.arpa udp
US 8.8.8.8:53 shorturl.at udp
US 104.26.8.129:443 shorturl.at tcp
US 8.8.8.8:53 129.8.26.104.in-addr.arpa udp
US 8.8.8.8:53 www.shorturl.at udp
US 104.26.9.129:443 www.shorturl.at tcp
US 8.8.8.8:53 www.dropbox.com udp
US 162.125.8.18:443 www.dropbox.com tcp
US 8.8.8.8:53 129.9.26.104.in-addr.arpa udp
US 8.8.8.8:53 18.8.125.162.in-addr.arpa udp
US 104.26.8.129:443 www.shorturl.at tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp

Files

memory/4476-1-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/4476-0-0x0000000000FE0000-0x00000000011CA000-memory.dmp

memory/4476-2-0x0000000005B40000-0x0000000005B50000-memory.dmp

memory/4476-3-0x0000000005B50000-0x0000000005BCC000-memory.dmp

memory/4476-4-0x0000000005BD0000-0x0000000005C48000-memory.dmp

memory/4476-5-0x0000000005CB0000-0x0000000005D18000-memory.dmp

memory/4476-6-0x0000000005D20000-0x0000000005D6C000-memory.dmp

memory/4476-7-0x0000000006340000-0x00000000068E4000-memory.dmp

memory/3408-8-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4476-12-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/3408-11-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3408-13-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3408-14-0x00000000016A0000-0x00000000016A7000-memory.dmp

memory/3408-15-0x0000000003260000-0x0000000003660000-memory.dmp

memory/3408-16-0x0000000003260000-0x0000000003660000-memory.dmp

memory/3408-17-0x0000000003260000-0x0000000003660000-memory.dmp

memory/3408-18-0x0000000003260000-0x0000000003660000-memory.dmp

memory/3408-19-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3408-22-0x0000000003260000-0x0000000003660000-memory.dmp

memory/440-23-0x0000029499F60000-0x0000029499F63000-memory.dmp

memory/3408-24-0x0000000004070000-0x00000000040A6000-memory.dmp

memory/3408-30-0x0000000004070000-0x00000000040A6000-memory.dmp

memory/3408-31-0x0000000003260000-0x0000000003660000-memory.dmp

memory/3408-32-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3408-33-0x0000000003260000-0x0000000003660000-memory.dmp

memory/440-34-0x0000029499F60000-0x0000029499F63000-memory.dmp

memory/440-35-0x000002949C010000-0x000002949C017000-memory.dmp

memory/440-36-0x00007FF441CC0000-0x00007FF441DEF000-memory.dmp

memory/440-37-0x00007FF441CC0000-0x00007FF441DEF000-memory.dmp

memory/440-38-0x00007FF441CC0000-0x00007FF441DEF000-memory.dmp

memory/440-39-0x00007FF441CC0000-0x00007FF441DEF000-memory.dmp

memory/440-40-0x00007FF441CC0000-0x00007FF441DEF000-memory.dmp

memory/440-44-0x00007FF441CC0000-0x00007FF441DEF000-memory.dmp

memory/440-42-0x00007FF441CC0000-0x00007FF441DEF000-memory.dmp

memory/440-45-0x00007FF441CC0000-0x00007FF441DEF000-memory.dmp

memory/440-46-0x00007FF441CC0000-0x00007FF441DEF000-memory.dmp

memory/440-47-0x00007FF83D2D0000-0x00007FF83D4C5000-memory.dmp

memory/440-48-0x00007FF441CC0000-0x00007FF441DEF000-memory.dmp

memory/440-49-0x00007FF441CC0000-0x00007FF441DEF000-memory.dmp

memory/440-50-0x00007FF441CC0000-0x00007FF441DEF000-memory.dmp

memory/440-51-0x00007FF441CC0000-0x00007FF441DEF000-memory.dmp

memory/440-52-0x00007FF441CC0000-0x00007FF441DEF000-memory.dmp

memory/440-54-0x00007FF83D2D0000-0x00007FF83D4C5000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/3652-57-0x00000000008C0000-0x0000000000900000-memory.dmp

memory/3652-59-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/3652-58-0x0000000005130000-0x000000000516E000-memory.dmp

memory/3652-61-0x0000000005180000-0x00000000051AC000-memory.dmp

memory/3652-60-0x00000000052C0000-0x00000000052D0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe

MD5 ecfe62777946dfed18d22fc8b2015a37
SHA1 ec602fc687056f285587b1182fa9777bbf50ab63
SHA256 4911e4611c08d1a54bbe1a3a7d8d801e468968825ed639ed22880fc7e1b0ae7a
SHA512 05657c0add30a2616042f87c0ea91d7faedf69b4e9bd9ff693bc7a1f854c8ab09a423d19ff165dfa9208e14bbfa2dbf7f468f3fce970d6aaa3cfa9fc76b0374b

C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe

MD5 ecfe62777946dfed18d22fc8b2015a37
SHA1 ec602fc687056f285587b1182fa9777bbf50ab63
SHA256 4911e4611c08d1a54bbe1a3a7d8d801e468968825ed639ed22880fc7e1b0ae7a
SHA512 05657c0add30a2616042f87c0ea91d7faedf69b4e9bd9ff693bc7a1f854c8ab09a423d19ff165dfa9208e14bbfa2dbf7f468f3fce970d6aaa3cfa9fc76b0374b

memory/1752-65-0x0000000000820000-0x00000000008AC000-memory.dmp

memory/1752-68-0x0000000074490000-0x0000000074C40000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/760-84-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\kZT7q].exe

MD5 ecfe62777946dfed18d22fc8b2015a37
SHA1 ec602fc687056f285587b1182fa9777bbf50ab63
SHA256 4911e4611c08d1a54bbe1a3a7d8d801e468968825ed639ed22880fc7e1b0ae7a
SHA512 05657c0add30a2616042f87c0ea91d7faedf69b4e9bd9ff693bc7a1f854c8ab09a423d19ff165dfa9208e14bbfa2dbf7f468f3fce970d6aaa3cfa9fc76b0374b

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/760-78-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/1752-85-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/3652-86-0x0000000074490000-0x0000000074C40000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/1752-70-0x0000000002C20000-0x0000000002C30000-memory.dmp

memory/1752-69-0x0000000005140000-0x0000000005172000-memory.dmp

memory/1752-67-0x0000000005100000-0x0000000005144000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\y4EOMcZXl.exe

MD5 2544c951135bba7846e943cf22a7eb59
SHA1 099bf354174088d2c0cf68638bb441be60d7775f
SHA256 14eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512 e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff

memory/440-87-0x000002949C010000-0x000002949C015000-memory.dmp

memory/440-88-0x00007FF83D2D0000-0x00007FF83D4C5000-memory.dmp

memory/3152-89-0x0000000002320000-0x0000000002336000-memory.dmp

memory/760-90-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D1C2.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

C:\Users\Admin\AppData\Local\Temp\D1C2.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/1532-103-0x00000000002F0000-0x0000000000360000-memory.dmp

memory/1532-105-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/1532-107-0x0000000004BE0000-0x0000000004C14000-memory.dmp

memory/1532-106-0x0000000004C90000-0x0000000004CA0000-memory.dmp

memory/1532-104-0x0000000004B60000-0x0000000004BA6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D34A.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

C:\Users\Admin\AppData\Local\Temp\D34A.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/2776-112-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D1C2.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/2676-114-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/2676-113-0x0000000000650000-0x00000000006CC000-memory.dmp

memory/1532-118-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/2776-120-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2676-119-0x0000000004BE0000-0x0000000004C72000-memory.dmp

memory/2676-122-0x0000000004C80000-0x0000000004D1C000-memory.dmp

memory/2776-121-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D1C2.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\D1C2.exe.log

MD5 4a911455784f74e368a4c2c7876d76f4
SHA1 a1700a0849ffb4f26671eb76da2489946b821c34
SHA256 264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA512 4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

memory/4484-125-0x0000000002900000-0x0000000002946000-memory.dmp

memory/4484-126-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/4484-127-0x0000000004E80000-0x0000000004E90000-memory.dmp

memory/2676-128-0x0000000005B10000-0x0000000005B20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D1C2.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/2676-133-0x0000000005A60000-0x0000000005AA2000-memory.dmp

memory/3264-135-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4484-134-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/2676-136-0x0000000005D30000-0x0000000005D3A000-memory.dmp

memory/2676-137-0x0000000005B10000-0x0000000005B20000-memory.dmp

memory/2676-138-0x0000000006FB0000-0x0000000006FCA000-memory.dmp

memory/2676-139-0x0000000006F90000-0x0000000006F96000-memory.dmp

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\D1C2.exe

MD5 16a47e164bd3d0ded59d301a75362a09
SHA1 cd0d5d280208f0f8a93549a727df797e6ea2dd49
SHA256 68e04834ecd4bd7e4fc7c29f5314fb785e2232c43d02564feb20bc8569cbd315
SHA512 589618430010de95b7f0f8f9f3ecf5fef7d6cb79d75705fb201ace7dce1477ba459483605882cfd700aa4730dceb94b9b6735c375c82d311184ecea42adc88f7

memory/2776-150-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2776-151-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2776-152-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2776-155-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2776-157-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2776-158-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2776-171-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2776-159-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2776-174-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2776-177-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2776-163-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2776-222-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2676-245-0x0000000074490000-0x0000000074C40000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[31E588D1-3483].[[email protected]].8base

MD5 ff751779b2df82d0aafc3c315a41a7e0
SHA1 cbd38fd2347ba7e8b077587e654af131eee948d9
SHA256 580b52d71606a26888fa18cfd1938e92a76d252ec15c931bbfbe3ad549a87092
SHA512 280414e1b0d2828b01300d04ceca3f517f1dd7e12eaefae3ed9d4efbf8257dd16e88108018e7e3fa6357a8ef9d6a5d90c67843ed0ab09ef9f447403049dcd2b4

C:\Users\Admin\AppData\Local\Temp\D34A.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/2676-391-0x0000000005B10000-0x0000000005B20000-memory.dmp

memory/2676-393-0x0000000005B10000-0x0000000005B20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D34A.exe

MD5 20bb118569b859e64feaaf30227e04b8
SHA1 3fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512 567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c

memory/2676-1405-0x0000000074490000-0x0000000074C40000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ob75hbeb.default-release\cookies.sqlite.id[31E588D1-3483].[[email protected]].8base

MD5 ffa17760cc8b571bf91c23a4a3a8fb0c
SHA1 7746e689a1e29042c665a2ee58ab0fd83cdaa35e
SHA256 c39ff0d97eafced92f57c16050ae455b9f278d0aef4764550e9f71561275138d
SHA512 f270c3394aa29648096144199a563fc85a3ea28c394c7c9e34b8f1bf4847252f4150ea679f47d160faf84edbea5d4bcc2fbc9077067748c6279f619d277246e8