Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
105s -
max time network
72s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
11/05/2021, 13:15
Static task
static1
Behavioral task
behavioral1
Sample
26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
Resource
win10v20210410
General
-
Target
26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
-
Size
997KB
-
MD5
ba454585b9f42c7254c931c192556e08
-
SHA1
0b530303634283a43d53abd9190106869f57ba5a
-
SHA256
26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa
-
SHA512
2cb918eab6776c7cfea031cbb48cc4e33e068489a37f39ba1e246f32fef7a35c3511293b399c81b5b8056bca50d725554866584460f04efe0d65c1d1c625bc4b
Malware Config
Signatures
-
Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
-
Modifies Windows Firewall 1 TTPs
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ProtectGet.tiff 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Globalization\MCT\MCT-GB\Link\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Offline Web Pages\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Media\Calligraphy\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Media\Garden\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\H18KNA1T\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Globalization\MCT\MCT-US\Link\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VFDYFLB4\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Media\Delta\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Media\Sonata\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\Music\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Public\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Media\Afternoon\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Public\Documents\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Media\Festival\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\Cookies\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HNHPAZTY\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Media\Heritage\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
description flow ioc HTTP URL 10 http://www.sfml-dev.org/ip-provider.php -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\regedit.exe 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR39F.GIF 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285822.WMF.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Internet Explorer\networkinspection.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143745.GIF.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01141_.WMF.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\ActionsPane3.xsd 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ru.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libdirectory_demux_plugin.dll.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00685_.WMF.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0297759.WMF 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\InformationIcon.jpg 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL104.XML 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099197.GIF 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\GRDEN_01.MID.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Java\jre7\lib\security\java.policy 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Luxembourg.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00440_.WMF.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15073_.GIF 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SMSS.ICO 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.password.template.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Java\jre7\lib\security\cacerts 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_hail.png 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105846.WMF 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Real.mpp.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01568_.WMF 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\REPTWIZ.POC.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\desktop.ini.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\THMBNAIL.PNG.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196142.WMF.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02053J.JPG.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\gmail.crx.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Costa_Rica.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll.[[email protected]][ID-T5NYGOHC3PL942Z].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GFX.DLL 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Cursors\pen_il.cur 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\manageSingleRole.aspx 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Web.RegularE#\fc4fb8a45f4e2115c1290af5ffe5ace0\System.Web.RegularExpressions.ni.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.8dc504e4#\53cf54ff35686c4044952a8cf8b8021e\System.Web.ApplicationServices.ni.dll.aux 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Help\mui\0409\scanmanagement.CHM 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\IME\IMESC5\DICTS\PINTLGB.IMD 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\inf\prnrc007.inf 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe.config 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe.config 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\diagnostics\system\Printer\DiagPackage.diagpkg 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Help\mui\0409\authfw.CHM 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Help\Windows\en-US\ics.h1s 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\inf\mdmgl006.PNF 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Claims.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\legacy.web_mediumtrust.config 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Resources\Themes\Aero\en-US\aero.msstyles.mui 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\diagnostics\system\Networking\UtilitySetConstants.ps1 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.WinFx.targets 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-CodecPack-Basic-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt73a1fc9d#\0e4b3c951459254c78b0c1f9c52d8c9a\System.Runtime.Remoting.ni.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Fonts\FRSCRIPT.TTF 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Media\Windows Navigation Start.wav 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework\sbs_microsoft.jscript.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\inf\net8187se64.PNF 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data14bed3a9#\d0c8be245fc6926e7a71200dc2b288af\System.Data.Services.Client.ni.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\alink.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\PolicyDefinitions\GroupPolicy.admx 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-IIS-WebServer-AddOn-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.cat 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-PowerShell-Client-WTR-Package~31bf3856ad364e35~amd64~en-US~7.2.7601.16406.cat 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_en_31bf3856ad364e35\TaskScheduler.resources.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Design\d6d1ba722a664cd9315cb28715ed3468\System.Design.ni.dll.aux 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\ehome\Microsoft.MediaCenter.Sports.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\inf\agp.inf 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\inf\net1qx64.PNF 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\normnfc.nlp 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Cursors\size4_r.cur 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\diagnostics\system\Printer\RS_SpoolerCrashing.ps1 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\diagnostics\system\WindowsMediaPlayerConfiguration\RS_ConfigurationErrors.ps1 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\inf\prngt003.inf 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1038\eula.rtf 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExecRemote.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\System.ServiceModel\ac74a0642981011a441823a762bfb3d8\System.ServiceModel.ni.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Fonts\mangalb.ttf 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\nlssorting.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMDiagnostics.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Fonts\taile.ttf 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\system.core.dll_gac_x86 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.WorkflowServices\v4.0_4.0.0.0__31bf3856ad364e35\System.WorkflowServices.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\System.ServiceModel.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.JScript.tlb 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Prefetch\CONHOST.EXE-1F3E9D7E.pf 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-SecureStartup-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\inf\angel64.PNF 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\inf\prnca00f.PNF 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\inf\wiabr009.inf 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\regsvcs.exe.config 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\error.aspx.resx 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspx 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\home2.aspx.resx 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Windows\Fonts\coue1255.fon 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe -
NTFS ADS 42 IoCs
description ioc Process File opened for modification C:\ProgramData\Templates\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\ꞔ痽"쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Favorites\Updater6\ꞔ痽"쀀\ꞔ痽:쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Default\Cookies\Roaming\ꞔ痽"쀀\ꞔ痽:쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Application Data\Updater6\"쀀秸p秸pꨚ痽\:쀀kkꨚ痽\:쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀k 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Favorites\Updater6\ꞔ痽"쀀炨p瀀pꨚ痽\ꞔ痽:쀀㯸v㯠vꨚ痽 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Documents\Updater6\ꞔ痽"쀀\ꞔ痽:쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Documents and Settings\S-1-5-21-2455352368-1077083310-2879168483-1000\ꞔ痽"쀀\ꞔ痽:쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\ProgramData\Documents\Updater6\ꞔ痽"쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\ProgramData\Favorites\Updater6\ꞔ痽"쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\System Volume Information\34107922-98a6-11eb-a15f-ea91f6580701\ꞔ痽"쀀\ꞔ痽:쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\System Volume Information\34107922-98a6-11eb-a15f-ea91f6580701\ꞔ痽"쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Local\History\Chrome\ꞔ痽"쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Local\Temporary Internet Files\WPDNSE\ꞔ痽"쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\Application Data\Roaming\ꞔ痽"쀀\ꞔ痽:쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Desktop\Updater6\"쀀稐p稐pꨚ痽\:쀀kkꨚ痽\:쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀k 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Start Menu\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\ꞔ痽"쀀炨p灸pꨚ痽\ꞔ痽:쀀ﭸuﭠuꨚ痽 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Local\Application Data\Color\ꞔ痽"쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Local\Temporary Internet Files\WPDNSE\ꞔ痽"쀀\ꞔ痽:쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\Application Data\Roaming\ꞔ痽"쀀r⭰rꨚ痽\ꞔ痽:쀀㚐r㙸rꨚ痽 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Desktop\Updater6\ꞔ痽"쀀炨p濐pꨚ痽\ꞔ痽:쀀㯸v㯠vꨚ痽 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Documents\Updater6\ꞔ痽"쀀炨p濨pꨚ痽\ꞔ痽:쀀㯸v㯠vꨚ痽 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Default\Cookies\Roaming\ꞔ痽"쀀ⴸr⮈rꨚ痽\ꞔ痽:쀀븘q븀qꨚ痽 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Documents and Settings\S-1-5-21-2455352368-1077083310-2879168483-1000\ꞔ痽"쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\ProgramData\Desktop\Updater6\ꞔ痽"쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Local\Application Data\Color\ꞔ痽"쀀\ꞔ痽:쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Desktop\Updater6\ꞔ痽"쀀\ꞔ痽:쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\ProgramData\Desktop\Updater6\"쀀瓰p瓰pꨚ痽\:쀀নnনnꨚ痽\:쀀ৈnৈnꨚ痽\3쀀২n২nꨚ痽\3쀀ਨnਨnꨚ痽\3쀀ੈnੈnꨚ痽\3쀀੨n੨nꨚ痽\3쀀ਈnਈnꨚ痽\3쀀નnનnꨚ痽\3쀀ૈnૈnꨚ痽\3쀀૨n૨nꨚ痽\3쀀ଈnଈnꨚ痽\3쀀ନnନnꨚ痽\3쀀ୈnୈnꨚ痽\3쀀୨n୨nꨚ痽\3쀀熰l熰lꨚ痽\3쀀燐l燐lꨚ痽\3쀀燰l燰lꨚ痽\3쀀爐l爐lꨚ痽\3쀀爰lŐjꨚ痽żj 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Local\History\Chrome\ꞔ痽"쀀芸y舨yꨚ痽\ꞔ痽:쀀kkꨚ痽\ꞔ痽:쀀kkꨚ痽 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Default\Application Data\Roaming\ꞔ痽"쀀\ꞔ痽:쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Templates\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\ꞔ痽"쀀炨p炐pꨚ痽\ꞔ痽:쀀ﭸuﭠuꨚ痽 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Local\History\Chrome\ꞔ痽"쀀\ꞔ痽:쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Application Data\Updater6\ꞔ痽"쀀\ꞔ痽:쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Start Menu\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\ꞔ痽"쀀\ꞔ痽:쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Application Data\Updater6\ꞔ痽"쀀炨p澸pꨚ痽\ꞔ痽:쀀㯸v㯠vꨚ痽 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Local\Temporary Internet Files\WPDNSE\ꞔ痽"쀀芸y芠yꨚ痽\ꞔ痽:쀀檠u檈uꨚ痽\ꞔ痽:쀀檀u橨uꨚ痽 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Default\Application Data\Roaming\ꞔ痽"쀀ⴸr⭰rꨚ痽\ꞔ痽:쀀븘q븀qꨚ痽 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Documents and Settings\S-1-5-21-2455352368-1077083310-2879168483-1000\"쀀墨o墨oꨚ痽\:쀀kkꨚ痽\:쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀kkꨚ痽\3쀀Ȁ 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\ProgramData\Application Data\Updater6\ꞔ痽"쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\ProgramData\Application Data\Updater6\"쀀瓘p瓘pꨚ痽\:쀀নnনnꨚ痽\:쀀ৈnৈnꨚ痽\3쀀২n২nꨚ痽\3쀀ਨnਨnꨚ痽\3쀀ੈnੈnꨚ痽\3쀀੨n੨nꨚ痽\3쀀ਈnਈnꨚ痽\3쀀નnનnꨚ痽\3쀀ૈnૈnꨚ痽\3쀀૨n૨nꨚ痽\3쀀ଈnଈnꨚ痽\耀\3쀀ୈnୈnꨚ痽\Őj୨nżjꨚ痽 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\ProgramData\Start Menu\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\ꞔ痽"쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\All Users\Templates\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\ꞔ痽"쀀\ꞔ痽:쀀\ꞔ痽:쀀 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Users\Admin\AppData\Local\Application Data\Color\ꞔ痽"쀀芸y臸yꨚ痽\ꞔ痽:쀀kkꨚ痽\ꞔ痽:쀀kkꨚ痽 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1944 wrote to memory of 1984 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 26 PID 1944 wrote to memory of 1984 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 26 PID 1944 wrote to memory of 1984 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 26 PID 1944 wrote to memory of 1984 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 26 PID 1984 wrote to memory of 1356 1984 cmd.exe 29 PID 1984 wrote to memory of 1356 1984 cmd.exe 29 PID 1984 wrote to memory of 1356 1984 cmd.exe 29 PID 1984 wrote to memory of 1356 1984 cmd.exe 29 PID 1356 wrote to memory of 516 1356 net.exe 30 PID 1356 wrote to memory of 516 1356 net.exe 30 PID 1356 wrote to memory of 516 1356 net.exe 30 PID 1356 wrote to memory of 516 1356 net.exe 30 PID 1944 wrote to memory of 584 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 31 PID 1944 wrote to memory of 584 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 31 PID 1944 wrote to memory of 584 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 31 PID 1944 wrote to memory of 584 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 31 PID 584 wrote to memory of 820 584 cmd.exe 33 PID 584 wrote to memory of 820 584 cmd.exe 33 PID 584 wrote to memory of 820 584 cmd.exe 33 PID 584 wrote to memory of 820 584 cmd.exe 33 PID 820 wrote to memory of 872 820 net.exe 34 PID 820 wrote to memory of 872 820 net.exe 34 PID 820 wrote to memory of 872 820 net.exe 34 PID 820 wrote to memory of 872 820 net.exe 34 PID 1944 wrote to memory of 1808 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 35 PID 1944 wrote to memory of 1808 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 35 PID 1944 wrote to memory of 1808 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 35 PID 1944 wrote to memory of 1808 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 35 PID 1808 wrote to memory of 1768 1808 cmd.exe 37 PID 1808 wrote to memory of 1768 1808 cmd.exe 37 PID 1808 wrote to memory of 1768 1808 cmd.exe 37 PID 1808 wrote to memory of 1768 1808 cmd.exe 37 PID 1768 wrote to memory of 1764 1768 net.exe 38 PID 1768 wrote to memory of 1764 1768 net.exe 38 PID 1768 wrote to memory of 1764 1768 net.exe 38 PID 1768 wrote to memory of 1764 1768 net.exe 38 PID 1944 wrote to memory of 1792 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 39 PID 1944 wrote to memory of 1792 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 39 PID 1944 wrote to memory of 1792 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 39 PID 1944 wrote to memory of 1792 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 39 PID 1792 wrote to memory of 316 1792 cmd.exe 41 PID 1792 wrote to memory of 316 1792 cmd.exe 41 PID 1792 wrote to memory of 316 1792 cmd.exe 41 PID 1792 wrote to memory of 316 1792 cmd.exe 41 PID 316 wrote to memory of 1788 316 net.exe 42 PID 316 wrote to memory of 1788 316 net.exe 42 PID 316 wrote to memory of 1788 316 net.exe 42 PID 316 wrote to memory of 1788 316 net.exe 42 PID 1944 wrote to memory of 1672 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 43 PID 1944 wrote to memory of 1672 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 43 PID 1944 wrote to memory of 1672 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 43 PID 1944 wrote to memory of 1672 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 43 PID 1672 wrote to memory of 1776 1672 cmd.exe 45 PID 1672 wrote to memory of 1776 1672 cmd.exe 45 PID 1672 wrote to memory of 1776 1672 cmd.exe 45 PID 1672 wrote to memory of 1776 1672 cmd.exe 45 PID 1776 wrote to memory of 1684 1776 net.exe 46 PID 1776 wrote to memory of 1684 1776 net.exe 46 PID 1776 wrote to memory of 1684 1776 net.exe 46 PID 1776 wrote to memory of 1684 1776 net.exe 46 PID 1944 wrote to memory of 1584 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 47 PID 1944 wrote to memory of 1584 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 47 PID 1944 wrote to memory of 1584 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 47 PID 1944 wrote to memory of 1584 1944 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe"C:\Users\Admin\AppData\Local\Temp\26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLWriter2⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\net.exenet stop SQLWriter3⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter4⤵PID:516
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLBrowser2⤵
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\SysWOW64\net.exenet stop SQLBrowser3⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser4⤵PID:872
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER2⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER3⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER4⤵PID:1764
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO12⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\net.exenet stop MSSQL$CONTOSO13⤵
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$CONTOSO14⤵PID:1788
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSDTC2⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\net.exenet stop MSDTC3⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSDTC4⤵PID:1684
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵PID:1584
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no2⤵PID:1704
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet2⤵PID:528
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT2⤵PID:1644
-
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT3⤵PID:508
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT4⤵PID:276
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER2⤵PID:2044
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER3⤵PID:984
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER4⤵PID:1196
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop vds2⤵PID:1088
-
C:\Windows\SysWOW64\net.exenet stop vds3⤵PID:1860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vds4⤵PID:1192
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off2⤵PID:1592
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set currentprofile state off3⤵PID:572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable2⤵PID:1804
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵PID:1760
-
-