Malware Analysis Report

2024-08-06 16:03

Sample ID 240501-ndh89afg46
Target XClient.exe
SHA256 3a23809b4f8c295cc07fb589966ef0c695d6df61c244e28127be54874ef38ec4
Tags
persistence chaos bootkit discovery ransomware upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3a23809b4f8c295cc07fb589966ef0c695d6df61c244e28127be54874ef38ec4

Threat Level: Known bad

The file XClient.exe was found to be: Known bad.

Malicious Activity Summary

persistence chaos bootkit discovery ransomware upx

Chaos Ransomware

Chaos

Checks computer location settings

Executes dropped EXE

Drops startup file

UPX packed file

Looks up external IP address via web service

Adds Run key to start application

Drops desktop.ini file(s)

Checks installed software on the system

Writes to the Master Boot Record (MBR)

AutoIT Executable

Drops autorun.inf file

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Program crash

Opens file in notepad (likely ransom note)

Modifies registry class

Suspicious use of SendNotifyMessage

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Replication Through Removable Media
T1091
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Pre-OS Boot
T1542
Bootkit
T1542.003
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Pre-OS Boot
T1542
Bootkit
T1542.003
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Replication Through Removable Media
T1091
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-01 11:16

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-01 11:16

Reported

2024-05-01 11:33

Platform

win7-20240215-en

Max time kernel

996s

Max time network

996s

Command Line

"C:\Users\Admin\AppData\Local\Temp\XClient.exe"

Signatures

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bgekgo.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\ProgramData\\XClient.exe" C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bgekgo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bgekgo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bgekgo.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bgekgo.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2832 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2832 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2832 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2832 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2832 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2832 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2832 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2832 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2832 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2832 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\bgekgo.exe
PID 2832 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\bgekgo.exe
PID 2832 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\bgekgo.exe
PID 2832 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\bgekgo.exe

Processes

C:\Users\Admin\AppData\Local\Temp\XClient.exe

"C:\Users\Admin\AppData\Local\Temp\XClient.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'

C:\Users\Admin\AppData\Local\Temp\bgekgo.exe

"C:\Users\Admin\AppData\Local\Temp\bgekgo.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 hydraduck.duckdns.org udp
SA 176.45.27.6:80 hydraduck.duckdns.org tcp
US 8.8.8.8:53 hydraduck.duckdns.org udp
SA 176.45.27.6:80 hydraduck.duckdns.org tcp
US 8.8.8.8:53 hydraduck.duckdns.org udp
SA 176.45.27.6:80 hydraduck.duckdns.org tcp

Files

memory/2832-0-0x0000000000E00000-0x0000000000F5C000-memory.dmp

memory/2832-1-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

memory/2832-2-0x000000001BEB0000-0x000000001BF30000-memory.dmp

memory/2548-7-0x000000001B6A0000-0x000000001B982000-memory.dmp

memory/2548-8-0x0000000002350000-0x0000000002358000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 758d03cdfeaea1429a55452cce47dd72
SHA1 05ad9b901f4ca29a8f0293d9ac917d0be692387b
SHA256 59e46663686441c96975863df8bcefa37a9f04197e4e584b4a58438b7d8d0292
SHA512 11e0781685265dfcfae36017bf1e5b37568004779d80124299175fd1fc956430bb5cf7c8ffe083e12396219951842219bae91d917e7dd06a3638b32395ffbc19

memory/2668-14-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

memory/2668-15-0x0000000002790000-0x0000000002798000-memory.dmp

memory/2832-27-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

memory/2832-29-0x0000000000DD0000-0x0000000000DDA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bgekgo.exe

MD5 22cee09d1b29de08f3bd7b340e8afcbf
SHA1 169050c72ec8369668282ce8fd2f7b645c532455
SHA256 f6a8d6117962b2f48c77aa14bd01a9962bb8d7a87d752fa50df76cdbd6e56533
SHA512 0514c39bcc76ffba415f46aba8cec5f82f5d349b49b2f2ad402e1b2445cc342622781d19a5d77a62f300ba3c1b3522b684f948dad59b5ff6503316c2610b49c9

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-01 11:16

Reported

2024-05-01 11:26

Platform

win10v2004-20240426-en

Max time kernel

585s

Max time network

596s

Command Line

"C:\Users\Admin\AppData\Local\Temp\XClient.exe"

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\test.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\svchost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\test.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\EthicalHackingTools1.1\EthicalHackingTools.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\kwdxjh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\baslvl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xzjaer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\whpjfn.exe N/A
N/A N/A C:\Program Files (x86)\EthicalHackingTools1.1\EthicalHackingTools.exe N/A
N/A N/A C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
N/A N/A C:\Users\Admin\Desktop\ddd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32_4709_toolbar = "C:\\Users\\Admin\\Desktop\\testing.bat" C:\Windows\system32\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\ProgramData\\XClient.exe" C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Store = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Checks installed software on the system

discovery

Drops desktop.ini file(s)

Description Indicator Process Target
File created F:\$RECYCLE.BIN\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\Desktop\ddd.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops autorun.inf file

Description Indicator Process Target
File created \??\B:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\S:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\W:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\J:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\B:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\M:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\X:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\A:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification C:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\Z:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\Y:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification D:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\O:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\S:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\T:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\L:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\N:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\R:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\V:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created D:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\H:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\I:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\K:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\K:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\P:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\E:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\L:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\N:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created F:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\O:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\T:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\Q:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\R:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\X:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\Z:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\U:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created C:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification F:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\H:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\J:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\E:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\I:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\Y:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\M:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\Q:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\G:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\G:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\U:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\A:\autorun.inf C:\Windows\system32\cmd.exe N/A
File created \??\P:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\V:\autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification \??\W:\autorun.inf C:\Windows\system32\cmd.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\EthicalHackingTools1.1\ransom_builder.$$A C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe N/A
File created C:\Program Files (x86)\EthicalHackingTools1.1\ddostool.$$A C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe N/A
File created C:\Program Files (x86)\EthicalHackingTools1.1\mbrimage.$$A C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe N/A
File created C:\Program Files (x86)\EthicalHackingTools1.1\msgspammer.$$A C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe N/A
File opened for modification C:\Program Files (x86)\EthicalHackingTools1.1\Uninstal.exe C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe N/A
File created C:\Program Files (x86)\EthicalHackingTools1.1\1234.$$A C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe N/A
File created C:\Program Files (x86)\EthicalHackingTools1.1\exel_icon.$$A C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe N/A
File created C:\Program Files (x86)\EthicalHackingTools1.1\Uninstal.$$A C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe N/A
File created C:\Program Files (x86)\EthicalHackingTools1.1\Form1.$$A C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe N/A
File created C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.$$A C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe N/A
File created C:\Program Files (x86)\EthicalHackingTools1.1\thematrix.$$A C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe N/A
File created C:\Program Files (x86)\EthicalHackingTools1.1\trojangen.$$A C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe N/A
File created C:\Program Files (x86)\EthicalHackingTools1.1\EthicalHackingTools.$$A C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\Desktop\ddd.exe

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6 C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\MRUListEx = 00000000ffffffff C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\MRUListEx = ffffffff C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 19002f433a5c000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe1100000096c7af35d697da0165473838d697da0129c8fb38d697da0114000000 C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic" C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic" C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A
N/A N/A C:\Users\Admin\Desktop\test.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\baslvl.exe N/A
N/A N/A C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\test.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\test.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\ddd.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bzydhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\zulcyg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xzjaer.exe N/A
N/A N/A C:\Program Files (x86)\EthicalHackingTools1.1\EthicalHackingTools.exe N/A
N/A N/A C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2004 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2004 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2004 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2004 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2004 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2004 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2004 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\kwdxjh.exe
PID 2004 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\kwdxjh.exe
PID 2004 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\kwdxjh.exe
PID 1164 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\kwdxjh.exe C:\Windows\SysWOW64\cmd.exe
PID 1164 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\kwdxjh.exe C:\Windows\SysWOW64\cmd.exe
PID 1164 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\kwdxjh.exe C:\Windows\SysWOW64\cmd.exe
PID 2004 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\bzydhn.exe
PID 2004 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\bzydhn.exe
PID 1960 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\bzydhn.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 1960 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\bzydhn.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 2040 wrote to memory of 3448 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 2040 wrote to memory of 3448 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 1076 wrote to memory of 4632 N/A C:\Users\Admin\Desktop\test.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 1076 wrote to memory of 4632 N/A C:\Users\Admin\Desktop\test.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 4632 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 4632 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Roaming\svchost.exe C:\Windows\system32\NOTEPAD.EXE
PID 1960 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\bzydhn.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 1960 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\bzydhn.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 5084 wrote to memory of 908 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 5084 wrote to memory of 908 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 2936 wrote to memory of 2420 N/A C:\Users\Admin\Desktop\test.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2936 wrote to memory of 2420 N/A C:\Users\Admin\Desktop\test.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2004 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\zulcyg.exe
PID 2004 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\zulcyg.exe
PID 2004 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\zulcyg.exe
PID 4056 wrote to memory of 2352 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 4056 wrote to memory of 2352 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2004 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\baslvl.exe
PID 2004 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\baslvl.exe
PID 2004 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\baslvl.exe
PID 2004 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe
PID 2004 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe
PID 2004 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe
PID 2004 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\xzjaer.exe
PID 2004 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\xzjaer.exe
PID 2004 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\xzjaer.exe
PID 2004 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\whpjfn.exe
PID 2004 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\whpjfn.exe
PID 2004 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\XClient.exe C:\Users\Admin\AppData\Local\Temp\whpjfn.exe
PID 4288 wrote to memory of 3596 N/A C:\Program Files (x86)\EthicalHackingTools1.1\EthicalHackingTools.exe C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe
PID 4288 wrote to memory of 3596 N/A C:\Program Files (x86)\EthicalHackingTools1.1\EthicalHackingTools.exe C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe
PID 4288 wrote to memory of 3596 N/A C:\Program Files (x86)\EthicalHackingTools1.1\EthicalHackingTools.exe C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe
PID 4288 wrote to memory of 1592 N/A C:\Program Files (x86)\EthicalHackingTools1.1\EthicalHackingTools.exe C:\Windows\SysWOW64\cmd.exe
PID 4288 wrote to memory of 1592 N/A C:\Program Files (x86)\EthicalHackingTools1.1\EthicalHackingTools.exe C:\Windows\SysWOW64\cmd.exe
PID 4288 wrote to memory of 1592 N/A C:\Program Files (x86)\EthicalHackingTools1.1\EthicalHackingTools.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\XClient.exe

"C:\Users\Admin\AppData\Local\Temp\XClient.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'

C:\Users\Admin\AppData\Local\Temp\kwdxjh.exe

"C:\Users\Admin\AppData\Local\Temp\kwdxjh.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3861.tmp\SpongebobFuck.cmd""

C:\Users\Admin\AppData\Local\Temp\bzydhn.exe

"C:\Users\Admin\AppData\Local\Temp\bzydhn.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ioscifxo\ioscifxo.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFBCB.tmp" "c:\Users\Admin\Desktop\CSC30CFA79422A4C90B95B12B85EA85EA6.TMP"

C:\Users\Admin\Desktop\test.exe

"C:\Users\Admin\Desktop\test.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c4vy00dz\c4vy00dz.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE030.tmp" "c:\Users\Admin\Desktop\CSC79656A0EDF64EEBA613D3C09B32EE4C.TMP"

C:\Users\Admin\Desktop\test.exe

"C:\Users\Admin\Desktop\test.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\zulcyg.exe

"C:\Users\Admin\AppData\Local\Temp\zulcyg.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\testing.bat" "

C:\Windows\system32\reg.exe

reg add "hklm\Software\Microsoft\Windows\CurrentVersion\Run" /v "rundll32_4709_toolbar" /t "REG_SZ" /d "C:\Users\Admin\Desktop\testing.bat" /f

C:\Users\Admin\AppData\Local\Temp\baslvl.exe

"C:\Users\Admin\AppData\Local\Temp\baslvl.exe"

C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe

"C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe"

C:\Users\Admin\AppData\Local\Temp\xzjaer.exe

"C:\Users\Admin\AppData\Local\Temp\xzjaer.exe"

C:\Users\Admin\AppData\Local\Temp\whpjfn.exe

"C:\Users\Admin\AppData\Local\Temp\whpjfn.exe"

C:\Program Files (x86)\EthicalHackingTools1.1\EthicalHackingTools.exe

"C:\Program Files (x86)\EthicalHackingTools1.1\EthicalHackingTools.exe"

C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe

"C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x404 0x408

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\EthicalHackingTools1.1\ddostool.bat" "

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

C:\Users\Admin\Desktop\ddd.exe

"C:\Users\Admin\Desktop\ddd.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2768 -ip 2768

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 488

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.90:443 www.bing.com tcp
US 8.8.8.8:53 134.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 90.61.62.23.in-addr.arpa udp
NL 23.62.61.90:443 www.bing.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 hydraduck.duckdns.org udp
SA 176.45.27.6:80 hydraduck.duckdns.org tcp
US 8.8.8.8:53 6.27.45.176.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 133.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 104.193.132.51.in-addr.arpa udp

Files

memory/2004-0-0x0000000000730000-0x000000000088C000-memory.dmp

memory/2004-1-0x00007FFB9CE20000-0x00007FFB9D8E1000-memory.dmp

memory/2004-2-0x000000001BB60000-0x000000001BB70000-memory.dmp

memory/2084-4-0x000002337F010000-0x000002337F020000-memory.dmp

memory/2084-3-0x00007FFB9CE20000-0x00007FFB9D8E1000-memory.dmp

memory/2084-6-0x0000023366AD0000-0x0000023366AF2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_idncdupx.r5j.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2084-5-0x000002337F010000-0x000002337F020000-memory.dmp

memory/2084-18-0x00007FFB9CE20000-0x00007FFB9D8E1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 96e3b86880fedd5afc001d108732a3e5
SHA1 8fc17b39d744a9590a6d5897012da5e6757439a3
SHA256 c3077e4cadb4ed246c02abe55aa6cf832fee4c2546b7addb7d22cd1c7c8c1294
SHA512 909b1968f7204fa7029109b02232d8cc5438f6b4dc7c9044e4e47c59fcee538199b13029e36592b12ed573d48a308dd4822d2ced4129ab08d4111897e02be55d

memory/2004-48-0x00007FFB9CE20000-0x00007FFB9D8E1000-memory.dmp

memory/2004-49-0x000000001BB60000-0x000000001BB70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kwdxjh.exe

MD5 ff4a17c39d21c1142b374bb10958eb26
SHA1 16ffa640cdc8c5d379d3d0f1ea99b8ae3f37013e
SHA256 2d6a69e59a296086964f4f1b54a6ec0f63c804754839996735f0dce4cdd853f2
SHA512 172b9fbd373b039c2c99314804676f87d7526d8d59bcf8314351502350002cdd104f3ba492536651f834df5b90c28abec5ff972cf49bac34013649e0779fa8e1

memory/1164-61-0x0000000000400000-0x00000000007BF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3861.tmp\SpongebobFuck.cmd

MD5 7a918ed93f7fb297e05464edccc46756
SHA1 9464288fed7ba5d88928265882def5e05ffbe7db
SHA256 82fcb47b437dc1bedb77648755770b7cd9a29342fd2ab972c8bd063968d04604
SHA512 cb70d6023b4bf23f35646e399c4ca7f0ab11ebf0a1e44cf0627afaa4025676c2a20ab82ffa28ed4a196dc8cf56b33b104bf457cf21d750a163955927dcba3cb1

memory/1164-74-0x0000000000400000-0x00000000007BF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bzydhn.exe

MD5 b20d5ada2e81683bda32aa80cd71c025
SHA1 1ab3daa872761d887ef0be9ace528ee323201211
SHA256 0d8b4a07e91e02335f600332644e8f0e504f75ab19899a58b2c85ecb0887c738
SHA512 94da5ae4e43e6b0fdc8d0a83d8a3f2991a47b6e12f6781cc6aecb2d8d97a2d0da6dc456e3618c1a36697862e1a7a50b27a036b3569f33889452fe921c6981d91

memory/1960-86-0x0000000000FD0000-0x000000000101E000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\ioscifxo\ioscifxo.cmdline

MD5 e879a5fec61f35c17d43c576fdf7b0cc
SHA1 1c1198c73fb32692cdae74c1c397a2065d41ff8f
SHA256 54702ac2745aa5d6655d2ba00a2110d9503c4c0126f4926f8877149528f9922a
SHA512 acbbc218354efa7bb77bf716752ddb112716db1f2e0f5b3cecfe05c461e834c5e0d677e1a89d5c3dbbb32d53169f33a40894b54008bb7072e4d4c08b5613f566

\??\c:\Users\Admin\AppData\Local\Temp\ioscifxo\ioscifxo.0.cs

MD5 158456bd9ff760a8da3b189f5b1d2835
SHA1 9d058b9912746a53a44d910d528497c1c7c145d9
SHA256 360ebd343d86d333df49dfae46813385bdd524e70f435034d7941c37b35e1874
SHA512 5a4ff6b5c631ed52ecc74d73e37d3749c8920ab5fcdd0433a94580d8f3413769d2b26729d1d2cb5e0194cda9c258fd959f09f90a5e0cd6d9cfcb8c98456957a3

\??\c:\Users\Admin\Desktop\CSC30CFA79422A4C90B95B12B85EA85EA6.TMP

MD5 4a8b69d1b2c8695736b8c2273da513dc
SHA1 6519bfd357318ebc69831e8c9a12626c5a34dc2e
SHA256 d9edfacf147f183b116c4ba680fe1087d13f04fa7dc92ca7e9bc9f2fdbca24b6
SHA512 e4bf306c4ff1b6be85fa7824ba7e9c50906e965553fcbcb9debd966220b0328134d99ceedc6d563296332056c243dd310e8fe36e2fee2c3864f7aa67fde225e5

C:\Users\Admin\AppData\Local\Temp\RESFBCB.tmp

MD5 ee11dc98945d96d1871802f481e8cbc6
SHA1 84868fc4a7d70d045e06f71dcd64a2a2ad4040f9
SHA256 f82a52372d379a4f2a4d115d1bc126b102cc3acbce455ade4aa3c30b1d4d78d5
SHA512 467dad1f9337f2b05193565fc85561d9da248c2f419abe39dc14e6ed5f43bb1c689262251e3c1664a3f15bc62cf21acd5ceead51a777b8eb5c8763a84aa61f2e

C:\Users\Admin\Desktop\test.exe

MD5 988204f5136f890cd7a4f154f8231c57
SHA1 6b462b89049e1ff082c6701c7aee96648d5a8a91
SHA256 f45378db30ff8143848065ba043f4c5ab66bc6b0ec9fb6fd314cd7dc6c616a75
SHA512 56605c7419d3e1b3d6201798e23adc64fb7b78cdf1aaacaa4a812038f3399776eb219eed1042e0c44f996c54adf463ff76ad80a296e2aed4bc154fb326d0eea1

memory/1076-109-0x0000000000430000-0x000000000043A000-memory.dmp

C:\Users\Admin\Pictures\read_it.txt

MD5 9814b140eb85668b095096dc0ac32702
SHA1 27e792330b4526b0f1ccb1eb212f9a80262353fd
SHA256 3d3a137cdf8a12a35f67451a8afead595b6281f3de271673606ee80a47de9eb0
SHA512 4caa4a28649dd76b4e845e928eb0893ad1a50cd4aaa6d58d3123303dcf07f42379171740a4d2c77ceb854b54c86f3c430ef6429bd5d10ad2b96fbcfef0a4fb13

\??\c:\Users\Admin\AppData\Local\Temp\c4vy00dz\c4vy00dz.cmdline

MD5 fa2d06a91d3e8cf9a622bd319f95437c
SHA1 24435240f4bc1e487267cf5b35ec805c696e8177
SHA256 d00284b54eb03909168f55b06eca727dc4557b7be65e438ff21915f35cc9b09b
SHA512 beada5a19f5ecdfbac88fbdd2fc2c3fd3e0ccb6ff45e6e7d8af0ca19747b73d1b0634889af3931a5fab150bf1cef469a2fdc6229b3bfe3141eb5c7f9f30d6756

\??\c:\Users\Admin\AppData\Local\Temp\c4vy00dz\c4vy00dz.0.cs

MD5 6346a98ae5907a512a4909a09972bb6f
SHA1 c10aaa27793d2a7446f816614c3b407147aa05c3
SHA256 7103779b4fed55e7c7756bbecc3d89bd3f15c315dac89d299771cd8ca9e20ab6
SHA512 151334e5fd39e5eab91107e5771bfa8d189f989dd946e58a104741ece317f8b76cb418c439ff135c9816284a8d0c0e4841a6d533847b8a64e40606e1917886ed

C:\Users\Admin\AppData\Local\Temp\RESE030.tmp

MD5 1cd757e214c73a64f3edde328d019116
SHA1 15e13f4d7b146e56a4736141147c9fb898ff9d7d
SHA256 b0103f5a3099fbc75bf72bd8de22134805597c61901aae78786e99bfa9c6303c
SHA512 65b44518bcfe16c8aee62d7487de01f12e1c32b225ea2dca7f7250062d1f1e3a1956220bd7e6d5a770cc6fa5ad0b15e137aa0f598e1a3116a82a8d73f5e5ae54

C:\Users\Admin\Desktop\test.exe

MD5 6944032d26e06baed796a9742251ac31
SHA1 62301958d5edb416be3b8c2b0502ce3d4d1787c6
SHA256 a9f431fe2e57a2d7bd75e09e9b9fb014ded5c5769895bea6b6eb013275f5331b
SHA512 f266bdfc2e6737808cf492630f75c21b150b18221f4c9c1acb7f269cacdfde24edfb24805268e786b7330f6f621a0727d27cf20c3831bb0af64f77bf05937087

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\test.exe.log

MD5 28d7fcc2b910da5e67ebb99451a5f598
SHA1 a5bf77a53eda1208f4f37d09d82da0b9915a6747
SHA256 2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c
SHA512 2d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6

memory/2936-267-0x0000000000320000-0x000000000032A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zulcyg.exe

MD5 75256220b5bfc94348a32685985af787
SHA1 a63e1eba08e1d0b520ca5e3ba92d07d0e938f430
SHA256 d6a5b4ac0b84250c190475874969626dc170ace6f51ccd9e5dea2d133fc377d5
SHA512 40a2642ac858546f477c98f3f50c9a3f8985a904e25438cc14de19ec1ac41fe681d5d8bcda8ec44f2c82c9076da279936bf852949deaa96f04780ab433c9b36d

memory/4516-282-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/4516-292-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/4516-313-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/4516-314-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/4516-315-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/4516-317-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/4516-318-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/4516-319-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/4516-320-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/4516-321-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/4516-323-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/4516-324-0x0000000000400000-0x00000000004B8000-memory.dmp

C:\Users\Admin\Desktop\testing.bat

MD5 064b315ebff516e67211c40f4e14f149
SHA1 014493d17c8d88f38565a6d1c4e9dcd85facaf52
SHA256 a48d8fcac4a3adfa9d6cf238e349ae6932c52bc1b61ea963847ef1803a57dcde
SHA512 5a000c6f52004a12745cabfb080751e581a844d1bdc3c6cfb12ea91d93a316f130a5d12c31c44d476d40a021c72a23cd9e83dbc496ffc60713cbfac177ca761f

memory/3252-347-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/3252-348-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/3252-349-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/3252-350-0x0000000000400000-0x00000000004B8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe

MD5 34a8f8ec1c50d5fd0c252d4937e54079
SHA1 680dc45eaf7419752fa259c996b9df1a53efa5d5
SHA256 953a03ddd88ad382e46e3b24add5708ec22081d6f2e31c9a25749556b5d94d31
SHA512 3d42e657edca311aad8632f0b9f8637a3aaa7af7313e640fb2afc27e8e4db204559c95400091f56044ae5f1617466a92a32cf18e71fbb4b0720c55397839bab7

C:\Users\Admin\AppData\Local\Temp\xzjaer.exe

MD5 0b43b506e0010463bf57fd24709e142e
SHA1 d8221e4984180537c838182c124e5981ba233bd9
SHA256 b381f91ddc80eaa54ca07e6b0e0efe786cfe9cfd42b04e1798e205e08eb8fcf6
SHA512 b4092096fd784de8f0e4fc51583f2a7a7e4bad6c1de2b44e37d7c39189aa0fb92e81b4f41345f9e6d39a07d77adcc216abbdccc7580d3a9e7e51a1180765ae01

memory/4444-371-0x0000000000400000-0x0000000000581000-memory.dmp

memory/4444-372-0x0000000000400000-0x0000000000581000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\whpjfn.exe

MD5 c8f5f007e75f79d7289568406b450a21
SHA1 424232cd270b7e7d255d440d25188097b9f0e465
SHA256 be0830713d84ebe82e0fd2a9380d4e4fba59b547691a14069ea024c8562396d4
SHA512 4de27d38bfcdfda879d81703d44a02d3699ce28d924ea509cabb106df9cdd03365f7386afcfdce5a8915555e733579221c152091802061c44c1a920f40873b73

memory/2520-383-0x0000000000400000-0x0000000000481000-memory.dmp

memory/2520-386-0x0000000000400000-0x0000000000481000-memory.dmp

memory/4444-387-0x0000000000400000-0x0000000000581000-memory.dmp

memory/4444-388-0x0000000000400000-0x0000000000581000-memory.dmp

memory/4444-389-0x0000000000400000-0x0000000000581000-memory.dmp

memory/4444-390-0x0000000000400000-0x0000000000581000-memory.dmp

C:\Program Files (x86)\EthicalHackingTools1.1\EthicalHackingTools.exe

MD5 53e061fea2a5569c480b715579d306ef
SHA1 0eab4fe52de5678d7e3e1e6cfaf87c6d81a10918
SHA256 4f3a5eea1ae0517bacf2edf4c762a4680ac5ddfba5b83ef46860ca517b08113f
SHA512 482a76192e97f8c39c8233fce31dd1fc33b75f0b294d1dd24704110d211ac9424e50ab72581de0e85f83cafb6f54ae85ba5c013417f8aea3dc2dfbd31d5ed9cb

C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe

MD5 631e45f7bd3d32363362f09cbfbdfbae
SHA1 6ae1e59d037b64f3c57c334ee521f8e9be6ea96f
SHA256 fef9f05fbb339b16a15848a1b4d743857ccca6e347818cad687dfc78119803e0
SHA512 7ee88c4d4f8543cbdb0e42e04cd6f5aa523c016d3753927a56fe8078f89d538adcb022d7ac95998fb1b0c5398c8c3cd9ec70d2b24ced2cca1f91fd8d6d62e429

memory/3596-434-0x0000000000400000-0x00000000004C4000-memory.dmp

C:\Program Files (x86)\EthicalHackingTools1.1\ddostool.bat

MD5 b23c59562f4f79ace361c2a05c91d11d
SHA1 6b17fbff2d7afd2cb4a6c623e941ee6567b222a9
SHA256 bc95616208f2681f38ac51b578cdb2e6d3003cb5c1873ec1095f074ffab498e1
SHA512 0f83295b69e486a24b5a0046c77aa41b41d87621ffabfe41e4b3d9c28977f6f0c07738f282bac2305082d6ac02822d8aa7befd8e965656b7f0d43098dab3d95d

memory/3596-436-0x0000000000400000-0x00000000004C4000-memory.dmp

memory/3596-437-0x0000000000400000-0x00000000004C4000-memory.dmp

C:\Users\Admin\Desktop\Ethical Hacking Tools.lnk

MD5 5c761b7515be2dc13256cee02334d954
SHA1 3921f2408ff2275baece5606478e1ad0fb3b4c50
SHA256 fff0fca43a6cd9cd468c11502ebdcc668e1c4af6a0986273ae5c4b5506ccd3ec
SHA512 862504937b2d3f2c508f53dc7f471908ca69f5b5c5892c813b9056fd6fe32419398b182a437d2e455f4a3af4643664dc6b1098465db256d9211448c517d9e169

memory/3596-446-0x0000000000400000-0x00000000004C4000-memory.dmp

memory/3596-447-0x0000000000400000-0x00000000004C4000-memory.dmp

C:\Users\Admin\Desktop\ddd.exe

MD5 b7f82b9aa806dbe9f106415f68a04b6e
SHA1 b327ed3fb7e2e62dc518700cba9cf862993c6a66
SHA256 8216f7ba09a98f434114a7ebd651a750fdda49f07e93e89e8b66a1f449cbf6aa
SHA512 66c45c8b7bfba1dc3aa5f25b9d0a9e5243b651c18208adf810646146c1ae9f6376377dd36e422dd1d6d5c8ee01529eb6adc0a233f507fd7c7aaf26f8765d1183