ouroboros | 33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3

Analysis

max time kernel
122s
max time network
143s
platform
windows10_x64
resource
win10-en
submitted
09-09-2021 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
Size

994KB
MD5

bfed6debcd8c3dbf8ea21655247ed3f0
SHA1

2b05bc9c9a14e3f9db8e758b2f5fa060857499bf
SHA256

33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3
SHA512

73a033937bc55f24a9089e493b3c8c3c6c058a77905ca1c09b73288ac5932328668d588add546a51779e36da6408c1aeab52af290a6bfae15391ac2d8faf9a28

Score

10^/10

ouroboros evasion ransomware spyware stealer

Malware Config

Signatures

Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
ransomware ouroboros
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\ClearNew.tiff	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\Pictures\CompleteInitialize.tiff	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe

Drops startup file 1 IoCs

Processes:

33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 64 IoCs

Processes:

33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\Cookies\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu Places\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\SystemData\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File created	C:\$Recycle.Bin\S-1-5-21-2559286294-2439613352-4032193287-1000\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File created	C:\Program Files\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2559286294-2439613352-4032193287-1000\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

description flow ioc

HTTP URL 13 http://www.sfml-dev.org/ip-provider.php
Drops file in System32 directory 1 IoCs

Processes:

33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\regedit.exe 33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe

description	flow	ioc
HTTP URL	13	http://www.sfml-dev.org/ip-provider.php

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\regedit.exe	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe

Drops file in Program Files directory 64 IoCs

Processes:

33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-96_altform-unplated_contrast-white.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-100.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_altform-unplated_contrast-black.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar.[[email protected]][PRJY5V4WM9OANCH].Spade	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxManifest.xml	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\165.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Livetiles\MicrosoftSolitaireAppList.targetsize-32_altform-unplated.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.[[email protected]][PRJY5V4WM9OANCH].Spade	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\Add-Numbers.Tests.ps1	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\ui-strings.js	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.[[email protected]][PRJY5V4WM9OANCH].Spade	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core.jar.[[email protected]][PRJY5V4WM9OANCH].Spade	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.boot.tree.dat	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\powerpointmui.msi.16.en-us.vreg.dat	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.dll.mui	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubAppList.scale-100.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\LargeTile.scale-100.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.[[email protected]][PRJY5V4WM9OANCH].Spade	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\OriginReport.Dotx.[[email protected]][PRJY5V4WM9OANCH].Spade	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\AppxManifest.xml	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\pageBackground.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ar.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-phn.xrm-ms	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.[[email protected]][PRJY5V4WM9OANCH].Spade	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\LargeTile.scale-125.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\ProjectionCylindric.scale-140.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-40_altform-unplated.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File created	C:\Program Files\Microsoft Office\root\vfs\SystemX86\concrt140.dll.[[email protected]][PRJY5V4WM9OANCH].Spade	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreWideTile.scale-200.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72_altform-unplated.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\bd_60x42.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-150.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.[[email protected]][PRJY5V4WM9OANCH].Spade	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar.[[email protected]][PRJY5V4WM9OANCH].Spade	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.[[email protected]][PRJY5V4WM9OANCH].Spade	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxLargeTile.scale-400.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.[[email protected]][PRJY5V4WM9OANCH].Spade	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\BRANDING.DLL	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ADO210.CHM.[[email protected]][PRJY5V4WM9OANCH].Spade	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72_contrast-black.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSO40UIRES.DLL	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\MedTile.scale-100.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\sample-thumb.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\ui-strings.js	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\starttile.dualsim2.sad.scale-200.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\ContactPhoto.scale-180.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\uk-ua\ui-strings.js	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinEditors.v8.1.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js.[[email protected]][PRJY5V4WM9OANCH].Spade	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-256.png	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore.winmd	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe

Drops file in Windows directory 64 IoCs

Processes:

33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe

description	ioc	process
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\15.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.SmartTag.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_de_31bf3856ad364e35\Microsoft.WSMan.Management.resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\AppPatch\fr-FR\AcRes.dll.mui	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\15.0.0.0__71e9bce111e9429c\Microsoft.Office.interop.access.dao.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\bopomofo.nlp	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Policy.14.0.Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\Policy.14.0.Microsoft.Vbe.Interop.config	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\Microsoft.ManagementConsole.Resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\explorer.exe	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\twain_32.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\extensibility.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\prcp.nlp	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.config	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.resources\3.0.0.0_ja_31bf3856ad364e35\PresentationBuildTasks.resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_de_31bf3856ad364e35\MMCEx.Resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Excel.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.SmartTag\15.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.SmartTag.config	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Policy.14.0.Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\Policy.14.0.Microsoft.Office.Interop.PowerPoint.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\winhlp32.exe	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\ksc.nlp	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\normnfkd.nlp	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Policy.14.0.Microsoft.Office.Interop.SmartTag\15.0.0.0__71e9bce111e9429c\Policy.14.0.Microsoft.Office.Interop.SmartTag.config	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\win.ini	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfd.nlp	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.resources\2.0.0.0_de_b03f5f7f11d50a3a\aspnetmmcext.resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Utilities.Resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_fr_b77a5c561934e089\mscorlib.Resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_fr_31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.Resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.Resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_fr_31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.Resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\AppPatch\sysmain.sdb	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\MSCOMCTL.DLL	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\Microsoft.Ink.Resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_fr_31bf3856ad364e35\MMCFxCommon.Resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Excel.config	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\PresentationCFFRasterizer.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\AppPatch\apppatch64\AcXtrnal.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_de_31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.Resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.resources\3.0.0.0_de_31bf3856ad364e35\PresentationBuildTasks.resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_de_31bf3856ad364e35\Microsoft.Ink.Resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_fr_31bf3856ad364e35\MMCEx.Resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Vbe.Interop.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_fr_31bf3856ad364e35\PresentationCore.resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\appcompat\Programs\Amcache.hve	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\AppPatch\de-DE\AcRes.dll.mui	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_ja_31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\AppPatch\AcLayers.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\ksc.nlp	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_ja_b03f5f7f11d50a3a\Microsoft.Build.Utilities.Resources.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.Office.Tools.Outlook.v9.0.dll	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe

NTFS ADS 31 IoCs

Processes:

33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe

description	ioc	process
File opened for modification	C:\Users\All Users\Desktop\Setup\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯Ɓ\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯΁\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\Documents\My Pictures\閳琯鐄¹\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀&\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\Àµ螴µ\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\衰µ\3쀀隚琯\Àµ蟴µ\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Documents and Settings\zh-TW\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\Àµ螴µ\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Documents and Settings\zh-TW\隚琯𼂸􀂸闎琯ex\:쀀隚琯倰¶倘¶闎琯\隚琯僰¶僘¶闎琯\3쀀隚琯丰¶丘¶闎琯\隚琯傰¶傘¶闎琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\AppData\Local\History\Chrome\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\߿\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\蟴µ\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\All Users\Documents\Setup\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯΁\3쀀隚琯\3쀀隚琯\Àµ衰µ\3쀀隚琯\߿\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\AppData\Local\Application Data\閳琯龌¸\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cache\閳琯ꃌ¸\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯΁\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\AppData\Local\History\Chrome\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\߿\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\AppData\Local\Application Data\Color\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\螄µ\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\߿\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\Documents\My Music\閳琯鐄¹\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\Àµ螔µ\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\Àµ蟀µ	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\Cookies\Roaming\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\߿\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\Documents\My Videos\閳琯鐄¹\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\Àµ螔µ\3쀀隚琯\3쀀隚琯\Àµ螴µ\3쀀隚琯\Àµ螔µ\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯Ɓ\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\螐µ\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\ProgramData\Documents\Setup\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\Àµ螴µ\3쀀隚琯\3쀀隚琯\3쀀\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\System Volume Information\WindowsRE\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\Àµ螴µ\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows Defender Advanced Threat Protection\Cache\閳琯ꑌ¸뮘Á묈Á闎琯ng̀\隚琯䧀¸䦐¸闎琯\:쀀隚琯亐¶乸¶闎琯Ȭ)\隚琯僰¶僘¶闎琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\Application Data\Roaming\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\Application Data\Roaming\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\߿\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯ݿ\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\ProgramData\Documents\Setup\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀u\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\System Volume Information\WindowsRE\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\All Users\Application Data\Setup\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\Àµ蠈µ\3쀀隚琯\3쀀隚琯\߿	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\Application Data\Roaming\隚琯İÃｨÂ闎琯t\:쀀隚琯ᅰ¹ᅘ¹闎琯xp\隚琯ᇰ¹ᇘ¹闎琯s\3쀀隚琯ቐ¹ሸ¹闎琯ie\隚琯ᇐ¹ᆸ¹闎琯Po	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Documents and Settings\zh-TW\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\ЀЀ隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\ProgramData\Desktop\Setup\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\Àµ螴µ\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀Ί\3쀀隚琯\3쀀隚琯\3쀀\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\Documents\My Music\閳琯鏄¹\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\Àµ螴µ\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows Defender Advanced Threat Protection\Cache\閳琯钄¹\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\߿\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\ProgramData\Documents\Setup\"쀀隚琯ÂÂ闎琯7A\隚琯僰¶僘¶闎琯i\:쀀隚琯儐¶僸¶闎琯\隚琯倰¶倘¶闎琯Ą\3쀀隚琯倐¶俸¶闎琯渨瞃\隚琯佰¶佘¶闎琯Ą\3쀀隚琯儰¶儘¶闎琯񏆟\隚琯估¶优¶闎琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\ProgramData\Desktop\Setup\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Admin\Application Data\Roaming\隚琯Ằ¹Რ¹闎琯rc\:쀀隚琯児¶儸¶闎琯ns\隚琯侰¶侘¶闎琯nt\3쀀隚琯买¶乘¶闎琯ef\隚琯亐¶乸¶闎琯.j\3쀀隚琯傰¶傘¶闎琯\隚琯侐¶佸¶闎琯ns	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\ProgramData\Application Data\Setup\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\߿\3쀀隚琯\3쀀隚琯\3쀀隚琯\ʈµ\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\Àµ螴µ\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
File opened for modification	C:\Users\Default\Cookies\Roaming\"쀀隚琯\:쀀隚琯\:쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\Àµ螴µ΁\3쀀隚琯\3쀀隚琯Ɓ\3쀀隚琯΂\3쀀隚琯\3쀀隚琯\3쀀隚琯\3쀀隚琯\Àµ蠀µ\3쀀隚琯\3쀀隚琯\3쀀隚琯	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe

pid	process
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.exe

description	pid	process	target process
PID 4564 wrote to memory of 4980	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 4980	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 4980	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4980 wrote to memory of 3200	4980	cmd.exe	net.exe
PID 4980 wrote to memory of 3200	4980	cmd.exe	net.exe
PID 4980 wrote to memory of 3200	4980	cmd.exe	net.exe
PID 3200 wrote to memory of 3724	3200	net.exe	net1.exe
PID 3200 wrote to memory of 3724	3200	net.exe	net1.exe
PID 3200 wrote to memory of 3724	3200	net.exe	net1.exe
PID 4564 wrote to memory of 4016	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 4016	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 4016	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4016 wrote to memory of 3144	4016	cmd.exe	net.exe
PID 4016 wrote to memory of 3144	4016	cmd.exe	net.exe
PID 4016 wrote to memory of 3144	4016	cmd.exe	net.exe
PID 3144 wrote to memory of 984	3144	net.exe	net1.exe
PID 3144 wrote to memory of 984	3144	net.exe	net1.exe
PID 3144 wrote to memory of 984	3144	net.exe	net1.exe
PID 4564 wrote to memory of 4172	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 4172	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 4172	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4172 wrote to memory of 4316	4172	cmd.exe	net.exe
PID 4172 wrote to memory of 4316	4172	cmd.exe	net.exe
PID 4172 wrote to memory of 4316	4172	cmd.exe	net.exe
PID 4316 wrote to memory of 4308	4316	net.exe	net1.exe
PID 4316 wrote to memory of 4308	4316	net.exe	net1.exe
PID 4316 wrote to memory of 4308	4316	net.exe	net1.exe
PID 4564 wrote to memory of 4332	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 4332	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 4332	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4332 wrote to memory of 4248	4332	cmd.exe	net.exe
PID 4332 wrote to memory of 4248	4332	cmd.exe	net.exe
PID 4332 wrote to memory of 4248	4332	cmd.exe	net.exe
PID 4248 wrote to memory of 2448	4248	net.exe	net1.exe
PID 4248 wrote to memory of 2448	4248	net.exe	net1.exe
PID 4248 wrote to memory of 2448	4248	net.exe	net1.exe
PID 4564 wrote to memory of 508	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 508	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 508	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 508 wrote to memory of 4224	508	cmd.exe	net.exe
PID 508 wrote to memory of 4224	508	cmd.exe	net.exe
PID 508 wrote to memory of 4224	508	cmd.exe	net.exe
PID 4224 wrote to memory of 2880	4224	net.exe	net1.exe
PID 4224 wrote to memory of 2880	4224	net.exe	net1.exe
PID 4224 wrote to memory of 2880	4224	net.exe	net1.exe
PID 4564 wrote to memory of 2884	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 2884	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 2884	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 2764	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 2764	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 2764	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 1072	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 1072	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 1072	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 1300	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 1300	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 4564 wrote to memory of 1300	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe
PID 1300 wrote to memory of 1456	1300	cmd.exe	net.exe
PID 1300 wrote to memory of 1456	1300	cmd.exe	net.exe
PID 1300 wrote to memory of 1456	1300	cmd.exe	net.exe
PID 1456 wrote to memory of 1624	1456	net.exe	net1.exe
PID 1456 wrote to memory of 1624	1456	net.exe	net1.exe
PID 1456 wrote to memory of 1624	1456	net.exe	net1.exe
PID 4564 wrote to memory of 1648	4564	33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe
"C:\Users\Admin\AppData\Local\Temp\33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop SQLWriter
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\SysWOW64\net.exe
    net stop SQLWriter
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLWriter
      4⤵
      PID:3724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop SQLBrowser
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\SysWOW64\net.exe
    net stop SQLBrowser
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3144
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLBrowser
      4⤵
      PID:984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLSERVER
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLSERVER
      4⤵
      PID:4308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$CONTOSO1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$CONTOSO1
      4⤵
      PID:2448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop MSDTC
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:508
- - C:\Windows\SysWOW64\net.exe
    net stop MSDTC
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSDTC
      4⤵
      PID:2880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:2884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
  2⤵
  PID:2764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
  2⤵
  PID:1072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\SysWOW64\net.exe
    net stop SQLSERVERAGENT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLSERVERAGENT
      4⤵
      PID:1624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
  2⤵
  PID:1648
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLSERVER
    3⤵
    PID:1376
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLSERVER
      4⤵
      PID:2056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop vds
  2⤵
  PID:2344
- - C:\Windows\SysWOW64\net.exe
    net stop vds
    3⤵
    PID:2552
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop vds
      4⤵
      PID:2148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
  2⤵
  PID:2816
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set currentprofile state off
    3⤵
    PID:3816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
  2⤵
  PID:204
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    PID:1972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/204-144-0x0000000000000000-mapping.dmp

Download
memory/508-127-0x0000000000000000-mapping.dmp

Download
memory/984-120-0x0000000000000000-mapping.dmp

Download
memory/1072-132-0x0000000000000000-mapping.dmp

Download
memory/1300-133-0x0000000000000000-mapping.dmp

Download
memory/1376-137-0x0000000000000000-mapping.dmp

Download
memory/1456-134-0x0000000000000000-mapping.dmp

Download
memory/1624-135-0x0000000000000000-mapping.dmp

Download
memory/1648-136-0x0000000000000000-mapping.dmp

Download
memory/1972-145-0x0000000000000000-mapping.dmp

Download
memory/2056-138-0x0000000000000000-mapping.dmp

Download
memory/2148-141-0x0000000000000000-mapping.dmp

Download
memory/2344-139-0x0000000000000000-mapping.dmp

Download
memory/2448-126-0x0000000000000000-mapping.dmp

Download
memory/2552-140-0x0000000000000000-mapping.dmp

Download
memory/2764-131-0x0000000000000000-mapping.dmp

Download
memory/2816-142-0x0000000000000000-mapping.dmp

Download
memory/2880-129-0x0000000000000000-mapping.dmp

Download
memory/2884-130-0x0000000000000000-mapping.dmp

Download
memory/3144-119-0x0000000000000000-mapping.dmp

Download
memory/3200-116-0x0000000000000000-mapping.dmp

Download
memory/3724-117-0x0000000000000000-mapping.dmp

Download
memory/3816-143-0x0000000000000000-mapping.dmp

Download
memory/4016-118-0x0000000000000000-mapping.dmp

Download
memory/4172-121-0x0000000000000000-mapping.dmp

Download
memory/4224-128-0x0000000000000000-mapping.dmp

Download
memory/4248-125-0x0000000000000000-mapping.dmp

Download
memory/4308-123-0x0000000000000000-mapping.dmp

Download
memory/4316-122-0x0000000000000000-mapping.dmp

Download
memory/4332-124-0x0000000000000000-mapping.dmp

Download
memory/4980-115-0x0000000000000000-mapping.dmp

Download