Malware Analysis Report

2024-11-30 02:48

Sample ID 240407-wxezyaag6v
Target 0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3
SHA256 0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3

Threat Level: Shows suspicious behavior

The file 0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3 was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

Suspicious behavior: RenamesItself

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 18:17

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 18:17

Reported

2024-04-07 18:20

Platform

win7-20240221-en

Max time kernel

150s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Shohdi.hdi C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification C:\Windows\SysWOW64\Shohdi.hdi C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created \??\c:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Java\jre7\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\7-Zip\7zFM.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Games\FreeCell\FreeCell.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\WINWORD.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Wordconv.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Java\jre7\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Java\jre7\bin\ssvagent.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Games\Purble Place\PurblePlace.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\SCANPST.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Games\Chess\Chess.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe

"C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe"

Network

N/A

Files

C:\Windows\SysWOW64\Shohdi.hdi

MD5 666b80251f7f255736d436ee241115ad
SHA1 8d37a7553b49f9ae1cb7355fce90e4bebe233f71
SHA256 0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3
SHA512 2a7c3f7a623bf18ca44a3883080e71e9d8d67988e9908e741b72db908af727fe2710d1f155b9c280b2a045ec73b4400de616fe58588ffa1cf05bbcfb1a11b412

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

MD5 ff770d586e13c91bed490bccb6d32f44
SHA1 c1b717a80647fa60713c3abc2df863af9c7f332b
SHA256 8ca6788c055e9298de1c6225b1947876c0b67f6c5726b4b35d6d27fd1ae30e6c
SHA512 4e6413d9282936c66c2ef2b85c4d9326a357ff7882341fdca6bb63b029598f3f4a7777289c6a0fff8a0592b52140b6bac342e3ef77e1f19dcdae66476ca2cf4a

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 53a679db7ee8118419b26acf6ea6e679
SHA1 cdafa9dd738b32d7c35da53b3623c298685adfe7
SHA256 7d58a2bef603ea18734d28f1026acc5e351cba57bbce26f3c2ea2ceff487657f
SHA512 42ba838b55e8bab442e48dc40dac998fb9bc5387b76ebcfe537d8f4d9bb478609f1e07e338b08c19eb52ec62f471d49040e80c4ce4480836e96adb8f1610b6e7

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 18:17

Reported

2024-04-07 18:20

Platform

win10v2004-20240319-en

Max time kernel

61s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe"

Signatures

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Shohdi.hdi C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification C:\Windows\SysWOW64\Shohdi.hdi C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Mozilla Firefox\firefox.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PPTICO.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\msoia.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTEM.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Mozilla Firefox\crashreporter.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\msoev.exe C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoia.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelper.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.sho C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe

"C:\Users\Admin\AppData\Local\Temp\0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4480 --field-trial-handle=2292,i,2927097380497635931,2014459809064723663,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
NL 142.250.179.138:443 tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
GB 172.165.61.93:443 tcp
IE 94.245.104.56:443 tcp
GB 51.140.244.186:443 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
NL 72.246.173.187:80 www.microsoft.com tcp
NL 72.246.173.187:80 www.microsoft.com tcp
US 8.8.8.8:53 187.173.246.72.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 17.143.109.104.in-addr.arpa udp
US 13.107.246.64:443 tcp

Files

C:\Windows\SysWOW64\Shohdi.hdi

MD5 666b80251f7f255736d436ee241115ad
SHA1 8d37a7553b49f9ae1cb7355fce90e4bebe233f71
SHA256 0677e005ed8fd37cc1ea57177ea394e8d5f64292776788f10eb93f9434dd71d3
SHA512 2a7c3f7a623bf18ca44a3883080e71e9d8d67988e9908e741b72db908af727fe2710d1f155b9c280b2a045ec73b4400de616fe58588ffa1cf05bbcfb1a11b412