Malware Analysis Report

2024-10-16 05:13

Sample ID 231025-z96vzage91
Target a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
SHA256 a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115
Tags
ammyyadmin phobos rhadamanthys smokeloader backdoor bootkit collection discovery evasion persistence ransomware rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115

Threat Level: Known bad

The file a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe was found to be: Known bad.

Malicious Activity Summary

ammyyadmin phobos rhadamanthys smokeloader backdoor bootkit collection discovery evasion persistence ransomware rat spyware stealer trojan

Ammyy Admin

Suspicious use of NtCreateUserProcessOtherParentProcess

Phobos

AmmyyAdmin payload

Detect rhadamanthys stealer shellcode

SmokeLoader

Rhadamanthys

Modifies boot configuration data using bcdedit

Renames multiple (70) files with added filename extension

Deletes shadow copies

Renames multiple (365) files with added filename extension

Deletes backup catalog

Downloads MZ/PE file

Modifies Windows Firewall

Checks computer location settings

Deletes itself

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Drops startup file

Drops desktop.ini file(s)

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Accesses Microsoft Outlook profiles

Writes to the Master Boot Record (MBR)

Checks installed software on the system

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Program crash

outlook_win_path

Suspicious behavior: GetForegroundWindowSpam

Delays execution with timeout.exe

Uses Volume Shadow Copy service COM API

Suspicious use of UnmapMainImage

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Interacts with shadow copies

Uses Task Scheduler COM API

outlook_office_path

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-25 21:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-25 21:26

Reported

2023-10-25 21:28

Platform

win7-20231023-en

Max time kernel

147s

Max time network

141s

Command Line

C:\Windows\Explorer.EXE

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2624 created 1196 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Renames multiple (70) files with added filename extension

ransomware

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\certreq.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\707F = "C:\\Users\\Admin\\AppData\\Local\\707F.exe" C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\707F = "C:\\Users\\Admin\\AppData\\Local\\707F.exe" C:\Users\Admin\AppData\Local\Temp\707F.exe N/A

Checks installed software on the system

discovery

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-3425689832-2386927309-2650718742-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3425689832-2386927309-2650718742-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\707F.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\F7B.tmp\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\Lang\lt.txt C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\msdaprsr.dll C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Internet Explorer\networkinspection.dll C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+6 C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\io.txt C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_sv.properties C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\Filters.xml C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chicago.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Ojinaga.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DissolveAnother.png C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Common Files\System\wab32.dll C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST5EDT.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Rangoon.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\7-Zip\License.txt.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bishkek.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Choibalsan.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\DisableJoin.pub.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.bat C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll.id[E3090175-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_shmem.dll C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\LICENSE C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.cpl C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd C:\Users\Admin\AppData\Local\Temp\707F.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\6BT.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\6BT.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\6BT.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Microsoft\HslIX7z3C].exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Microsoft\HslIX7z3C].exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\6BT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\6BT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\HslIX7z3C].exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\6BT.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\707F.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\F7B.tmp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2956 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 2956 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 2956 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 2956 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 2956 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 2956 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 2956 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 2956 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 2956 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 2624 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Windows\system32\certreq.exe
PID 2624 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Windows\system32\certreq.exe
PID 2624 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Windows\system32\certreq.exe
PID 2624 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Windows\system32\certreq.exe
PID 2624 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Windows\system32\certreq.exe
PID 2624 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Windows\system32\certreq.exe
PID 2944 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Microsoft\6BT.exe C:\Users\Admin\AppData\Local\Microsoft\6BT.exe
PID 2944 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Microsoft\6BT.exe C:\Users\Admin\AppData\Local\Microsoft\6BT.exe
PID 2944 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Microsoft\6BT.exe C:\Users\Admin\AppData\Local\Microsoft\6BT.exe
PID 2944 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Microsoft\6BT.exe C:\Users\Admin\AppData\Local\Microsoft\6BT.exe
PID 2944 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Microsoft\6BT.exe C:\Users\Admin\AppData\Local\Microsoft\6BT.exe
PID 2944 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Microsoft\6BT.exe C:\Users\Admin\AppData\Local\Microsoft\6BT.exe
PID 2944 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Microsoft\6BT.exe C:\Users\Admin\AppData\Local\Microsoft\6BT.exe
PID 2892 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Microsoft\HslIX7z3C].exe C:\Windows\SysWOW64\cmd.exe
PID 2892 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Microsoft\HslIX7z3C].exe C:\Windows\SysWOW64\cmd.exe
PID 2892 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Microsoft\HslIX7z3C].exe C:\Windows\SysWOW64\cmd.exe
PID 2892 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Microsoft\HslIX7z3C].exe C:\Windows\SysWOW64\cmd.exe
PID 400 wrote to memory of 1132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 400 wrote to memory of 1132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 400 wrote to memory of 1132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 400 wrote to memory of 1132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1196 wrote to memory of 2360 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 1196 wrote to memory of 2360 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 1196 wrote to memory of 2360 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 1196 wrote to memory of 2360 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2360 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2360 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2360 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2360 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2360 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2360 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2360 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2360 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2360 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2360 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2360 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2260 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2260 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2260 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2260 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2260 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2260 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2260 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2260 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2260 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2260 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 2260 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\707F.exe C:\Users\Admin\AppData\Local\Temp\707F.exe
PID 1196 wrote to memory of 1156 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1196 wrote to memory of 1156 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1196 wrote to memory of 1156 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1196 wrote to memory of 1156 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1196 wrote to memory of 1156 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1196 wrote to memory of 2028 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 1196 wrote to memory of 2028 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 1196 wrote to memory of 2028 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe

"C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe"

C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe

C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\HslIX7z3C].exe

"C:\Users\Admin\AppData\Local\Microsoft\HslIX7z3C].exe"

C:\Users\Admin\AppData\Local\Microsoft\6BT.exe

"C:\Users\Admin\AppData\Local\Microsoft\6BT.exe"

C:\Users\Admin\AppData\Local\Microsoft\hTxH4CRm0.exe

"C:\Users\Admin\AppData\Local\Microsoft\hTxH4CRm0.exe"

C:\Users\Admin\AppData\Local\Microsoft\6BT.exe

C:\Users\Admin\AppData\Local\Microsoft\6BT.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Microsoft\HslIX7z3C].exe" & del "C:\ProgramData\*.dll"" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 5

C:\Users\Admin\AppData\Local\Temp\707F.exe

C:\Users\Admin\AppData\Local\Temp\707F.exe

C:\Users\Admin\AppData\Local\Temp\707F.exe

C:\Users\Admin\AppData\Local\Temp\707F.exe

C:\Users\Admin\AppData\Local\Temp\707F.exe

"C:\Users\Admin\AppData\Local\Temp\707F.exe"

C:\Users\Admin\AppData\Local\Temp\707F.exe

C:\Users\Admin\AppData\Local\Temp\707F.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\F7B.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\F7B.tmp\svchost.exe -debug

C:\Windows\SysWOW64\ctfmon.exe

ctfmon.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 matthewsamuel.top udp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 amx435.xyz udp
DE 193.31.28.64:80 amx435.xyz tcp
US 8.8.8.8:53 files.catbox.moe udp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp

Files

memory/2956-1-0x00000000746E0000-0x0000000074DCE000-memory.dmp

memory/2956-0-0x00000000010C0000-0x0000000001422000-memory.dmp

memory/2956-2-0x0000000004E50000-0x0000000004E90000-memory.dmp

memory/2956-3-0x0000000005170000-0x000000000535E000-memory.dmp

memory/2956-4-0x00000000009A0000-0x0000000000A20000-memory.dmp

memory/2956-5-0x0000000000DB0000-0x0000000000E18000-memory.dmp

memory/2956-6-0x0000000001000000-0x0000000001068000-memory.dmp

memory/2956-7-0x0000000000780000-0x00000000007CC000-memory.dmp

memory/2624-8-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2624-9-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2624-10-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2624-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2624-12-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2624-16-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2956-18-0x00000000746E0000-0x0000000074DCE000-memory.dmp

memory/2624-19-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2624-20-0x0000000000240000-0x0000000000247000-memory.dmp

memory/2624-21-0x0000000000AC0000-0x0000000000EC0000-memory.dmp

memory/2624-24-0x0000000000AC0000-0x0000000000EC0000-memory.dmp

memory/2624-23-0x0000000000AC0000-0x0000000000EC0000-memory.dmp

memory/2668-25-0x0000000000060000-0x0000000000063000-memory.dmp

memory/2668-26-0x0000000000060000-0x0000000000063000-memory.dmp

memory/2624-27-0x0000000000270000-0x00000000002A6000-memory.dmp

memory/2624-33-0x0000000000AC0000-0x0000000000EC0000-memory.dmp

memory/2624-35-0x0000000000AC0000-0x0000000000EC0000-memory.dmp

memory/2624-34-0x0000000000270000-0x00000000002A6000-memory.dmp

memory/2624-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2668-38-0x00000000002A0000-0x00000000002A7000-memory.dmp

memory/2668-39-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2668-40-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2668-41-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2668-42-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2668-43-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2668-45-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2668-46-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2668-47-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2668-48-0x00000000774E0000-0x0000000077689000-memory.dmp

memory/2668-49-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2668-50-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2668-51-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2668-52-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\HslIX7z3C].exe

MD5 f445dce24fe09b59d9affb9f0a16ee7e
SHA1 9d2b2ef3e57c7a571c20d078dbac82576cdfcb30
SHA256 7476d2335a1f3cf87f1995a40147d6ee0acaf9cf0c9895a595365942b64be5a3
SHA512 6e721fbfc49a7780b20be1173795f602b3b4ccf9a8ce5625fc38ec15f818943dd7a0e56a75b4cb9719f2255b28d2ec538257f55ea383f2407069e5f93314edb8

memory/2668-56-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

memory/2668-58-0x00000000774E0000-0x0000000077689000-memory.dmp

memory/2892-62-0x0000000000250000-0x0000000000350000-memory.dmp

memory/2944-61-0x0000000000BA0000-0x0000000000E2E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\6BT.exe

MD5 a5e52d00a57904485aeb8e6580ce4666
SHA1 8f10588d8fcb6bb4d734c6e31fdaf2c165f87d92
SHA256 13d55838fe9e2e638ea8d21e86dab4fc28c8d9ba94526b79d48d0e83ce21fe71
SHA512 f14ca4c6017ffff6df0141cd706770225b9418029b69e37ff1f7d50ce2941cefb1e3f6d20df1897cb6cf3dc8db8e171d4ee94b72dac0b9375c31cb2e652b0b76

C:\Users\Admin\AppData\Local\Microsoft\6BT.exe

MD5 a5e52d00a57904485aeb8e6580ce4666
SHA1 8f10588d8fcb6bb4d734c6e31fdaf2c165f87d92
SHA256 13d55838fe9e2e638ea8d21e86dab4fc28c8d9ba94526b79d48d0e83ce21fe71
SHA512 f14ca4c6017ffff6df0141cd706770225b9418029b69e37ff1f7d50ce2941cefb1e3f6d20df1897cb6cf3dc8db8e171d4ee94b72dac0b9375c31cb2e652b0b76

memory/2944-64-0x0000000004450000-0x000000000456A000-memory.dmp

memory/2892-63-0x00000000003C0000-0x00000000003DB000-memory.dmp

memory/2892-66-0x0000000000400000-0x000000000062D000-memory.dmp

memory/2944-65-0x0000000074560000-0x0000000074C4E000-memory.dmp

memory/2944-67-0x0000000004D30000-0x0000000004D70000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\hTxH4CRm0.exe

MD5 2a40a56b3dbe361864baac57a7815de4
SHA1 a0b67c7eb5bb378010ada7a3cf6bfe4101df9049
SHA256 3d62c31dd2a3749a264d72bd87c287c9367d3198d612c5566ca54809b714af99
SHA512 6c426f00cac5bbf67fd6e56c95561b8ad94da32d1199cfbf5d9e3b2627b39cdf8e089856fd346a44097006a0f32a78480b32554f39ba4ceaf72182126f78e4b2

memory/2944-70-0x0000000000620000-0x000000000066A000-memory.dmp

memory/2944-72-0x0000000000A80000-0x0000000000AB2000-memory.dmp

memory/2944-71-0x0000000000A50000-0x0000000000A82000-memory.dmp

memory/1800-73-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1800-75-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\6BT.exe

MD5 a5e52d00a57904485aeb8e6580ce4666
SHA1 8f10588d8fcb6bb4d734c6e31fdaf2c165f87d92
SHA256 13d55838fe9e2e638ea8d21e86dab4fc28c8d9ba94526b79d48d0e83ce21fe71
SHA512 f14ca4c6017ffff6df0141cd706770225b9418029b69e37ff1f7d50ce2941cefb1e3f6d20df1897cb6cf3dc8db8e171d4ee94b72dac0b9375c31cb2e652b0b76

memory/1800-81-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2944-82-0x0000000074560000-0x0000000074C4E000-memory.dmp

memory/1800-79-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1800-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2892-83-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/2668-114-0x00000000002A0000-0x00000000002A2000-memory.dmp

memory/2668-115-0x00000000774E0000-0x0000000077689000-memory.dmp

memory/1196-122-0x0000000003900000-0x0000000003916000-memory.dmp

memory/1800-123-0x0000000000400000-0x000000000040B000-memory.dmp

\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/2892-145-0x0000000000250000-0x0000000000350000-memory.dmp

memory/2892-146-0x0000000000400000-0x000000000062D000-memory.dmp

memory/2892-157-0x0000000000250000-0x0000000000350000-memory.dmp

memory/2892-158-0x0000000000400000-0x000000000062D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\HslIX7z3C].exe

MD5 f445dce24fe09b59d9affb9f0a16ee7e
SHA1 9d2b2ef3e57c7a571c20d078dbac82576cdfcb30
SHA256 7476d2335a1f3cf87f1995a40147d6ee0acaf9cf0c9895a595365942b64be5a3
SHA512 6e721fbfc49a7780b20be1173795f602b3b4ccf9a8ce5625fc38ec15f818943dd7a0e56a75b4cb9719f2255b28d2ec538257f55ea383f2407069e5f93314edb8

C:\Users\Admin\AppData\Local\Temp\707F.exe

MD5 f4d64c9ae825a8b1e0db64c93d37eb2a
SHA1 03d03b2fcafc1fc36b960b6351e951fe40fb0c66
SHA256 c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec
SHA512 5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

C:\Users\Admin\AppData\Local\Temp\707F.exe

MD5 f4d64c9ae825a8b1e0db64c93d37eb2a
SHA1 03d03b2fcafc1fc36b960b6351e951fe40fb0c66
SHA256 c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec
SHA512 5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

memory/2360-171-0x0000000000060000-0x00000000002FA000-memory.dmp

memory/2360-172-0x00000000733E0000-0x0000000073ACE000-memory.dmp

memory/2360-173-0x0000000000A50000-0x0000000000A90000-memory.dmp

memory/2360-174-0x0000000004D00000-0x0000000004E26000-memory.dmp

memory/2360-175-0x00000000009D0000-0x0000000000A1E000-memory.dmp

memory/2360-176-0x00000000042E0000-0x0000000004316000-memory.dmp

memory/2360-177-0x0000000004320000-0x0000000004354000-memory.dmp

\Users\Admin\AppData\Local\Temp\707F.exe

MD5 f4d64c9ae825a8b1e0db64c93d37eb2a
SHA1 03d03b2fcafc1fc36b960b6351e951fe40fb0c66
SHA256 c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec
SHA512 5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

C:\Users\Admin\AppData\Local\Temp\707F.exe

MD5 f4d64c9ae825a8b1e0db64c93d37eb2a
SHA1 03d03b2fcafc1fc36b960b6351e951fe40fb0c66
SHA256 c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec
SHA512 5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

memory/2360-190-0x00000000733E0000-0x0000000073ACE000-memory.dmp

memory/1872-192-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\707F.exe

MD5 f4d64c9ae825a8b1e0db64c93d37eb2a
SHA1 03d03b2fcafc1fc36b960b6351e951fe40fb0c66
SHA256 c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec
SHA512 5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

memory/2260-194-0x0000000000060000-0x00000000002FA000-memory.dmp

memory/2260-195-0x0000000074560000-0x0000000074C4E000-memory.dmp

memory/2260-196-0x00000000044D0000-0x0000000004510000-memory.dmp

\Users\Admin\AppData\Local\Temp\707F.exe

MD5 f4d64c9ae825a8b1e0db64c93d37eb2a
SHA1 03d03b2fcafc1fc36b960b6351e951fe40fb0c66
SHA256 c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec
SHA512 5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

C:\Users\Admin\AppData\Local\Temp\707F.exe

MD5 f4d64c9ae825a8b1e0db64c93d37eb2a
SHA1 03d03b2fcafc1fc36b960b6351e951fe40fb0c66
SHA256 c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec
SHA512 5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

memory/2260-209-0x0000000074560000-0x0000000074C4E000-memory.dmp

memory/1836-211-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1156-215-0x0000000000080000-0x00000000000EB000-memory.dmp

memory/1156-213-0x0000000000180000-0x00000000001F5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\873C.tmp

MD5 f4c031bf36bab9f4c833ff6853e21e6d
SHA1 60f8f48f2dbe99039c1b51bdc583edb793247386
SHA256 fbe839712f81f119c2d401a6e893b0c9b867f9e05c9078ec2f380ac8033c9f35
SHA512 e2e17c0cd499460dc79b1e1d45b88abd35e84ecee9024e4f052e7eade371f7017fd88399ecf7bce1c23bc7926276660aef1d878ace1b571f50213e17fd6e057a

memory/1156-228-0x0000000000080000-0x00000000000EB000-memory.dmp

memory/2028-229-0x00000000000F0000-0x00000000000F7000-memory.dmp

memory/1872-231-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2028-232-0x0000000000060000-0x000000000006C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\707F.exe

MD5 f4d64c9ae825a8b1e0db64c93d37eb2a
SHA1 03d03b2fcafc1fc36b960b6351e951fe40fb0c66
SHA256 c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec
SHA512 5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab.id[E3090175-3483].[[email protected]].8base

MD5 cd08b79c19edbcb0e0b14ba3afcbf973
SHA1 0d81b69b15ab31c9ebe6db393ca82f432db22b19
SHA256 62170a674254d30bf4fa774f7d590542b25b82266bea3c04b2510045c45096ee
SHA512 262d00555ceda5619b3e78f6deeb7045e9bb860bfc62ec4b705b70af886f450e2f15102e194de60f0d5c64acd18cd01548b8771aa2989c603d73fd16d0716650

memory/2452-284-0x0000000000090000-0x0000000000094000-memory.dmp

memory/2452-289-0x0000000000080000-0x0000000000089000-memory.dmp

memory/2828-318-0x0000000000080000-0x000000000008B000-memory.dmp

memory/848-456-0x00000000000D0000-0x00000000000D7000-memory.dmp

memory/848-457-0x00000000000C0000-0x00000000000CB000-memory.dmp

memory/1356-459-0x0000000000070000-0x0000000000079000-memory.dmp

memory/1356-460-0x0000000000060000-0x000000000006F000-memory.dmp

memory/912-462-0x00000000000D0000-0x00000000000D5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F7B.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

\Users\Admin\AppData\Local\Temp\F7B.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

\Users\Admin\AppData\Local\Temp\F7B.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\F7B.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\F7B.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\Desktop\CompressUnregister.sql.id[E3090175-3483].[[email protected]].8base

MD5 4bb1285fdcb23787fbbd910f491e4638
SHA1 34f664cfb6522ec25e712a5e7e0f1fd1ed4f8226
SHA256 62e25405d7ffff8d4d4892cbddc3389fe772de3efcd6c6c93ffd652097062de1
SHA512 9db0db55307364a3e92991c9dde3e8225522402df622967457d78404f1a0191059afa6d2b535e61a041410ecd0cd61ac192e79ae62be754fc2cd1557f9e00fed

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-25 21:26

Reported

2023-10-25 21:28

Platform

win10v2004-20231020-en

Max time kernel

158s

Max time network

165s

Command Line

C:\Windows\Explorer.EXE

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1804 created 3132 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (365) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\certreq.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\B0CD = "C:\\Users\\Admin\\AppData\\Local\\B0CD.exe" C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\B0CD = "C:\\Users\\Admin\\AppData\\Local\\B0CD.exe" C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A

Checks installed software on the system

discovery

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3811856890-180006922-3689258494-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3811856890-180006922-3689258494-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\699D.tmp\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File created C:\Program Files\7-Zip\Lang\zh-tw.txt.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuin58_64.dll.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\BuildInfo.xml C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Reflection.DispatchProxy.dll C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.tree.dat C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-36_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OSFPROXY.DLL.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libty_plugin.dll.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailBadge.scale-125.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\CHIMES.WAV C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_MouseNose.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\tab_mru_darktheme.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-20.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-30.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.scale-200.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\lua\liblua_plugin.dll.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleSplashScreen.scale-125.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso20win32client.dll.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_SplashScreen.scale-200.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\WISC30.DLL C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File created C:\Program Files\Mozilla Firefox\vcruntime140.dll.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.scale-125.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-36.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-72_contrast-black.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\RunningLate.scale-64.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\WideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\2.jpg C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraMedTile.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OART.DLL.id[D15C46D2-3483].[[email protected]].8base C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\6vT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\6vT.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\6vT.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Windows\system32\certreq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\6vT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\6vT.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\6vT.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\699D.tmp\svchost.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1360 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1804 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Windows\system32\certreq.exe
PID 1804 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Windows\system32\certreq.exe
PID 1804 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Windows\system32\certreq.exe
PID 1804 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe C:\Windows\system32\certreq.exe
PID 4880 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Microsoft\6vT.exe C:\Users\Admin\AppData\Local\Microsoft\6vT.exe
PID 4880 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Microsoft\6vT.exe C:\Users\Admin\AppData\Local\Microsoft\6vT.exe
PID 4880 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Microsoft\6vT.exe C:\Users\Admin\AppData\Local\Microsoft\6vT.exe
PID 4880 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Microsoft\6vT.exe C:\Users\Admin\AppData\Local\Microsoft\6vT.exe
PID 4880 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Microsoft\6vT.exe C:\Users\Admin\AppData\Local\Microsoft\6vT.exe
PID 4880 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Microsoft\6vT.exe C:\Users\Admin\AppData\Local\Microsoft\6vT.exe
PID 4140 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe C:\Windows\SysWOW64\cmd.exe
PID 4140 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe C:\Windows\SysWOW64\cmd.exe
PID 4140 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe C:\Windows\SysWOW64\cmd.exe
PID 3556 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3556 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3556 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3132 wrote to memory of 2172 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 3132 wrote to memory of 2172 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 3132 wrote to memory of 2172 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 2172 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 2172 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 2172 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 2172 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 2172 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 2172 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 2172 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 2172 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 2172 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 2172 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 3688 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 3688 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 3688 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 3688 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 3688 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 3688 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 3688 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 3688 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 3688 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 3688 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Users\Admin\AppData\Local\Temp\B0CD.exe
PID 4324 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Windows\system32\cmd.exe
PID 4324 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Windows\system32\cmd.exe
PID 4324 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Windows\system32\cmd.exe
PID 4324 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\B0CD.exe C:\Windows\system32\cmd.exe
PID 1592 wrote to memory of 2840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1592 wrote to memory of 2840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4836 wrote to memory of 2652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4836 wrote to memory of 2652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4836 wrote to memory of 2244 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4836 wrote to memory of 2244 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1592 wrote to memory of 3828 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1592 wrote to memory of 3828 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1592 wrote to memory of 4548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 1592 wrote to memory of 4548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe

"C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe"

C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe

C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe

C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe

C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe

"C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe"

C:\Users\Admin\AppData\Local\Microsoft\6vT.exe

"C:\Users\Admin\AppData\Local\Microsoft\6vT.exe"

C:\Users\Admin\AppData\Local\Microsoft\6vT.exe

C:\Users\Admin\AppData\Local\Microsoft\6vT.exe

C:\Users\Admin\AppData\Local\Microsoft\6Ob4T.exe

"C:\Users\Admin\AppData\Local\Microsoft\6Ob4T.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe" & del "C:\ProgramData\*.dll"" & exit

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4140 -ip 4140

C:\Windows\SysWOW64\timeout.exe

timeout /t 5

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 2564

C:\Users\Admin\AppData\Local\Temp\B0CD.exe

C:\Users\Admin\AppData\Local\Temp\B0CD.exe

C:\Users\Admin\AppData\Local\Temp\B0CD.exe

C:\Users\Admin\AppData\Local\Temp\B0CD.exe

C:\Users\Admin\AppData\Local\Temp\B0CD.exe

"C:\Users\Admin\AppData\Local\Temp\B0CD.exe"

C:\Users\Admin\AppData\Local\Temp\B0CD.exe

C:\Users\Admin\AppData\Local\Temp\B0CD.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\699D.tmp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\699D.tmp\svchost.exe -debug

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 219.21.30.184.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 amxt25.xyz udp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 61.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
DE 45.131.66.61:80 amxt25.xyz tcp
DE 45.131.66.61:80 amxt25.xyz tcp
US 8.8.8.8:53 matthewsamuel.top udp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
US 8.8.8.8:53 88.129.139.37.in-addr.arpa udp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
DE 45.131.66.61:80 amxt25.xyz tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
NL 37.139.129.88:80 matthewsamuel.top tcp
US 8.8.8.8:53 servermlogs27.xyz udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 amx435.xyz udp
DE 193.31.28.64:80 amx435.xyz tcp
US 8.8.8.8:53 120.66.131.45.in-addr.arpa udp
US 8.8.8.8:53 64.28.31.193.in-addr.arpa udp
US 8.8.8.8:53 files.catbox.moe udp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 35.20.181.108.in-addr.arpa udp
DE 45.131.66.120:80 servermlogs27.xyz tcp
DE 45.131.66.120:80 servermlogs27.xyz tcp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

memory/1360-0-0x00000000746D0000-0x0000000074E80000-memory.dmp

memory/1360-1-0x0000000000830000-0x0000000000B92000-memory.dmp

memory/1360-2-0x0000000005580000-0x0000000005612000-memory.dmp

memory/1360-3-0x0000000005570000-0x0000000005580000-memory.dmp

memory/1360-4-0x0000000005620000-0x000000000580E000-memory.dmp

memory/1360-5-0x0000000005C80000-0x0000000005D00000-memory.dmp

memory/1360-6-0x0000000005950000-0x00000000059B8000-memory.dmp

memory/1360-7-0x00000000059F0000-0x0000000005A58000-memory.dmp

memory/1360-8-0x0000000005A60000-0x0000000005AAC000-memory.dmp

memory/1360-9-0x00000000062C0000-0x0000000006864000-memory.dmp

memory/1804-10-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1804-13-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1360-14-0x00000000746D0000-0x0000000074E80000-memory.dmp

memory/1804-15-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1804-16-0x0000000000EB0000-0x0000000000EB7000-memory.dmp

memory/1804-17-0x0000000002B50000-0x0000000002F50000-memory.dmp

memory/1804-18-0x0000000002B50000-0x0000000002F50000-memory.dmp

memory/1804-19-0x0000000002B50000-0x0000000002F50000-memory.dmp

memory/1804-20-0x0000000002B50000-0x0000000002F50000-memory.dmp

memory/3096-21-0x000001C0F2B10000-0x000001C0F2B13000-memory.dmp

memory/1804-22-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1804-23-0x0000000003890000-0x00000000038C6000-memory.dmp

memory/1804-30-0x0000000002B50000-0x0000000002F50000-memory.dmp

memory/1804-31-0x0000000002B50000-0x0000000002F50000-memory.dmp

memory/1804-29-0x0000000003890000-0x00000000038C6000-memory.dmp

memory/1804-32-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1804-33-0x0000000002B50000-0x0000000002F50000-memory.dmp

memory/3096-34-0x000001C0F2B10000-0x000001C0F2B13000-memory.dmp

memory/3096-35-0x000001C0F2CB0000-0x000001C0F2CB7000-memory.dmp

memory/3096-36-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

memory/3096-37-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

memory/3096-39-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

memory/3096-38-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

memory/3096-40-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

memory/3096-42-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

memory/3096-41-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

memory/3096-44-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

memory/3096-45-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

memory/3096-46-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

memory/3096-47-0x00007FFB7E1F0000-0x00007FFB7E3E5000-memory.dmp

memory/3096-48-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

memory/3096-49-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

memory/3096-50-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

memory/3096-51-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

memory/3096-52-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe

MD5 f445dce24fe09b59d9affb9f0a16ee7e
SHA1 9d2b2ef3e57c7a571c20d078dbac82576cdfcb30
SHA256 7476d2335a1f3cf87f1995a40147d6ee0acaf9cf0c9895a595365942b64be5a3
SHA512 6e721fbfc49a7780b20be1173795f602b3b4ccf9a8ce5625fc38ec15f818943dd7a0e56a75b4cb9719f2255b28d2ec538257f55ea383f2407069e5f93314edb8

C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe

MD5 f445dce24fe09b59d9affb9f0a16ee7e
SHA1 9d2b2ef3e57c7a571c20d078dbac82576cdfcb30
SHA256 7476d2335a1f3cf87f1995a40147d6ee0acaf9cf0c9895a595365942b64be5a3
SHA512 6e721fbfc49a7780b20be1173795f602b3b4ccf9a8ce5625fc38ec15f818943dd7a0e56a75b4cb9719f2255b28d2ec538257f55ea383f2407069e5f93314edb8

memory/4140-57-0x0000000000770000-0x0000000000870000-memory.dmp

memory/4140-58-0x0000000000750000-0x000000000076B000-memory.dmp

memory/4140-60-0x0000000000400000-0x000000000062D000-memory.dmp

memory/3096-59-0x00007FFB7E1F0000-0x00007FFB7E3E5000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\6vT.exe

MD5 a5e52d00a57904485aeb8e6580ce4666
SHA1 8f10588d8fcb6bb4d734c6e31fdaf2c165f87d92
SHA256 13d55838fe9e2e638ea8d21e86dab4fc28c8d9ba94526b79d48d0e83ce21fe71
SHA512 f14ca4c6017ffff6df0141cd706770225b9418029b69e37ff1f7d50ce2941cefb1e3f6d20df1897cb6cf3dc8db8e171d4ee94b72dac0b9375c31cb2e652b0b76

C:\Users\Admin\AppData\Local\Microsoft\6vT.exe

MD5 a5e52d00a57904485aeb8e6580ce4666
SHA1 8f10588d8fcb6bb4d734c6e31fdaf2c165f87d92
SHA256 13d55838fe9e2e638ea8d21e86dab4fc28c8d9ba94526b79d48d0e83ce21fe71
SHA512 f14ca4c6017ffff6df0141cd706770225b9418029b69e37ff1f7d50ce2941cefb1e3f6d20df1897cb6cf3dc8db8e171d4ee94b72dac0b9375c31cb2e652b0b76

memory/4880-64-0x00000000736F0000-0x0000000073EA0000-memory.dmp

memory/4880-65-0x00000000007D0000-0x0000000000A5E000-memory.dmp

memory/4880-67-0x0000000005400000-0x000000000551A000-memory.dmp

memory/4880-66-0x00000000052B0000-0x00000000052C0000-memory.dmp

memory/4880-68-0x0000000005680000-0x00000000056CA000-memory.dmp

memory/4880-69-0x0000000005910000-0x0000000005942000-memory.dmp

memory/4880-70-0x0000000005960000-0x0000000005992000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\6vT.exe

MD5 a5e52d00a57904485aeb8e6580ce4666
SHA1 8f10588d8fcb6bb4d734c6e31fdaf2c165f87d92
SHA256 13d55838fe9e2e638ea8d21e86dab4fc28c8d9ba94526b79d48d0e83ce21fe71
SHA512 f14ca4c6017ffff6df0141cd706770225b9418029b69e37ff1f7d50ce2941cefb1e3f6d20df1897cb6cf3dc8db8e171d4ee94b72dac0b9375c31cb2e652b0b76

memory/4364-71-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4364-74-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4880-75-0x00000000736F0000-0x0000000073EA0000-memory.dmp

memory/4140-76-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/4140-126-0x0000000000770000-0x0000000000870000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\Users\Admin\AppData\Local\Microsoft\6Ob4T.exe

MD5 2a40a56b3dbe361864baac57a7815de4
SHA1 a0b67c7eb5bb378010ada7a3cf6bfe4101df9049
SHA256 3d62c31dd2a3749a264d72bd87c287c9367d3198d612c5566ca54809b714af99
SHA512 6c426f00cac5bbf67fd6e56c95561b8ad94da32d1199cfbf5d9e3b2627b39cdf8e089856fd346a44097006a0f32a78480b32554f39ba4ceaf72182126f78e4b2

C:\Users\Admin\AppData\Local\Microsoft\6Ob4T.exe

MD5 2a40a56b3dbe361864baac57a7815de4
SHA1 a0b67c7eb5bb378010ada7a3cf6bfe4101df9049
SHA256 3d62c31dd2a3749a264d72bd87c287c9367d3198d612c5566ca54809b714af99
SHA512 6c426f00cac5bbf67fd6e56c95561b8ad94da32d1199cfbf5d9e3b2627b39cdf8e089856fd346a44097006a0f32a78480b32554f39ba4ceaf72182126f78e4b2

memory/3132-146-0x0000000001090000-0x00000000010A6000-memory.dmp

memory/4364-148-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4140-151-0x0000000000400000-0x000000000062D000-memory.dmp

memory/4140-159-0x0000000000400000-0x000000000062D000-memory.dmp

C:\ProgramData\Are.docx

MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

memory/3096-168-0x000001C0F2CB0000-0x000001C0F2CB5000-memory.dmp

memory/3096-169-0x00007FFB7E1F0000-0x00007FFB7E3E5000-memory.dmp

memory/4140-171-0x0000000000400000-0x000000000062D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B0CD.exe

MD5 f4d64c9ae825a8b1e0db64c93d37eb2a
SHA1 03d03b2fcafc1fc36b960b6351e951fe40fb0c66
SHA256 c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec
SHA512 5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

C:\Users\Admin\AppData\Local\Temp\B0CD.exe

MD5 f4d64c9ae825a8b1e0db64c93d37eb2a
SHA1 03d03b2fcafc1fc36b960b6351e951fe40fb0c66
SHA256 c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec
SHA512 5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

memory/2172-182-0x00000000746E0000-0x0000000074E90000-memory.dmp

memory/2172-183-0x0000000000550000-0x00000000007EA000-memory.dmp

memory/2172-185-0x00000000050E0000-0x0000000005206000-memory.dmp

memory/2172-184-0x0000000005030000-0x0000000005040000-memory.dmp

memory/2172-186-0x0000000005610000-0x000000000565E000-memory.dmp

memory/2172-187-0x0000000005660000-0x0000000005696000-memory.dmp

memory/2172-188-0x00000000056D0000-0x0000000005704000-memory.dmp

memory/4324-189-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B0CD.exe

MD5 f4d64c9ae825a8b1e0db64c93d37eb2a
SHA1 03d03b2fcafc1fc36b960b6351e951fe40fb0c66
SHA256 c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec
SHA512 5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

memory/4324-193-0x0000000000400000-0x0000000000413000-memory.dmp

memory/4324-195-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2172-194-0x00000000746E0000-0x0000000074E90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B0CD.exe

MD5 f4d64c9ae825a8b1e0db64c93d37eb2a
SHA1 03d03b2fcafc1fc36b960b6351e951fe40fb0c66
SHA256 c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec
SHA512 5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\B0CD.exe.log

MD5 4353288293ab8929e492327245a7ccb2
SHA1 89b365f2f5e14faaf17715e5764b60d344250d67
SHA256 61954fc5184dd88a959f803ee98ca9af53eb0c942dbb00b98ba4f8a46081b587
SHA512 48c07ca1b769cf02af6ec938aad8b5a03133e82a451bdff5a03bf4ba47cfd7add0ab28ee6622c22fb54e127472a7cf68dd7d05da15ec439cc18aed2ca76cd08a

memory/3688-198-0x00000000746E0000-0x0000000074E90000-memory.dmp

memory/3688-199-0x0000000005510000-0x0000000005520000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B0CD.exe

MD5 f4d64c9ae825a8b1e0db64c93d37eb2a
SHA1 03d03b2fcafc1fc36b960b6351e951fe40fb0c66
SHA256 c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec
SHA512 5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

memory/3688-204-0x00000000746E0000-0x0000000074E90000-memory.dmp

memory/1328-205-0x0000000000400000-0x0000000000413000-memory.dmp

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\B0CD.exe

MD5 f4d64c9ae825a8b1e0db64c93d37eb2a
SHA1 03d03b2fcafc1fc36b960b6351e951fe40fb0c66
SHA256 c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec
SHA512 5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[D15C46D2-3483].[[email protected]].8base

MD5 eb8edb1a6835240fd2268ea346239781
SHA1 98f929ddd52f83c51957965cff9faa1476fbfd5b
SHA256 313178517776024e31913d8f14d6a2f377de2f03093d182559043f9f1fb50bdc
SHA512 e6d4eff06246ed71cb2f682a4a7729825688c754691ccff4290a2b69ca81099b830c87291e27a09fcdb5bcada189171c67d22de1f12576dfa8cec00750fc6952

memory/4324-644-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1328-1326-0x0000000000400000-0x0000000000413000-memory.dmp

memory/5048-2985-0x0000000000C00000-0x0000000000C75000-memory.dmp

memory/5048-2988-0x0000000000960000-0x00000000009CB000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f3zxqty5.default-release\cookies.sqlite.id[D15C46D2-3483].[[email protected]].8base

MD5 5859fb39f856a489fa08d7a5376bfdcb
SHA1 6a4ffa31cdcdd44440a837e8a340dd7467adf710
SHA256 61090e02da87d4bdc9d2813025539b00a879f658c3c23bd4f96e648ce57de8a3
SHA512 30ae5fd1ece9614552f32fe6fed4d6d5adc39ecbd87a5e04d590115a91a7e1b523e72f9a382ceb2179d54115adbb77301a5d9b4e90da5a605cb1d4562994c2f8

C:\Users\Admin\AppData\Local\Temp\14D9.tmp

MD5 985339a523cfa3862ebc174380d3340c
SHA1 73bf03c8f7bc58b4e28bcbfdd1c2ba52dea5dfb7
SHA256 57c7f10cd97c8db447281ad0f47d4694035056e050b85b81f5a5124f461621a2
SHA512 b5d34c43330f8070b3f353c826a54aecd99b7129a214913a365b66009a1a6744093bf085d3f86681ed40c714d6ebdfff40d99d7bd7a3508a0a0caed6304ac27c

C:\Users\Admin\AppData\Local\Temp\14FB.tmp

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

memory/5048-3142-0x0000000000960000-0x00000000009CB000-memory.dmp

memory/3084-3270-0x0000000000510000-0x0000000000517000-memory.dmp

memory/3084-3283-0x0000000000500000-0x000000000050C000-memory.dmp

memory/4840-3459-0x00000000014D0000-0x00000000014D9000-memory.dmp

memory/4840-3456-0x00000000014E0000-0x00000000014E4000-memory.dmp

memory/4508-3524-0x0000000000440000-0x000000000044A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\699D.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

C:\Users\Admin\AppData\Local\Temp\699D.tmp\svchost.exe

MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be