Malware Analysis Report

2024-09-23 06:58

Sample ID 221116-gb64zadc2w
Target 16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5
SHA256 16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5
Tags
azov persistence ransomware spyware stealer wiper
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5

Threat Level: Known bad

The file 16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5 was found to be: Known bad.

Malicious Activity Summary

azov persistence ransomware spyware stealer wiper

Azov

Reads user/profile data of web browsers

Adds Run key to start application

Enumerates connected drives

Drops file in Program Files directory

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2022-11-16 05:38

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-16 05:38

Reported

2022-11-16 05:41

Platform

win7-20221111-en

Max time kernel

32s

Max time network

34s

Command Line

"C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe"

Signatures

Azov

ransomware wiper azov

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ar.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7MDT C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\bg.pak C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Internet Explorer\SIGNUP\install.ins C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.sfx C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bangkok C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Windows Defender\MSASCui.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fr.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\et.pak C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\mr.pak C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\eo.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ja.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5EDT C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10 C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\et.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guadalcanal C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Chisinau C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\si.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe

"C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe"

Network

N/A

Files

memory/1724-54-0x0000000000190000-0x0000000000194000-memory.dmp

memory/1724-55-0x00000000FF5D0000-0x00000000FF5F4000-memory.dmp

memory/1724-56-0x000007FEFBDF1000-0x000007FEFBDF3000-memory.dmp

memory/1724-59-0x0000000000190000-0x0000000000194000-memory.dmp

memory/1724-58-0x0000000000100000-0x0000000000105000-memory.dmp

memory/1724-57-0x00000000000E0000-0x00000000000E6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-16 05:38

Reported

2022-11-16 05:41

Platform

win10v2004-20221111-en

Max time kernel

72s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe"

Signatures

Azov

ransomware wiper azov

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Common Files\System\en-US\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\ConvertFromReset.ps1 C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ar.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hy.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msado20.tlb C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\eu.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sk.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mr.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ug.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nb.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\7-Zip\7zCon.sfx C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ja.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File created C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msador28.tlb C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Windows Mail\wab.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe

"C:\Users\Admin\AppData\Local\Temp\16ee5eb9bd028bf3665884b78a6d5eb595aa05d32eacd345d01bf337f4b602f5.exe"

Network

Country Destination Domain Proto
N/A 20.189.173.2:443 tcp
N/A 72.21.81.240:80 tcp
N/A 72.21.81.240:80 tcp
N/A 72.21.81.240:80 tcp
N/A 72.21.81.240:80 tcp

Files

memory/5088-132-0x0000000002440000-0x0000000002444000-memory.dmp

memory/5088-133-0x00007FF71F1A0000-0x00007FF71F1C4000-memory.dmp

memory/5088-134-0x0000000000AE0000-0x0000000000AE6000-memory.dmp

memory/5088-136-0x0000000002440000-0x0000000002444000-memory.dmp

memory/5088-135-0x0000000000C80000-0x0000000000C85000-memory.dmp