Edit tour

Windows Analysis Report
Iir6rxs8r6.exe

Overview

General Information

Sample name:	Iir6rxs8r6.exe renamed because original name is a hash value
Original sample name:	3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe
Analysis ID:	1524355
MD5:	2b825ea77e240d2ab6b6695a602cb07c
SHA1:	ae6eb3cce06f666934e03dd46269526e56aff3b1
SHA256:	3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f
Tags:	exeRhysidauser-JAMESWT_MHT
Infos:

Detection

Rhysida

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Rhysida Ransomware

AI detected suspicious sample

Changes the wallpaper picture

Found API chain indicative of debugger detection

Self deletion via cmd or bat file

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Suspicious Ping/Del Command Combination

Suspicious powershell command line found

Uses cmd line tools excessively to alter registry or file data

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Uses schtasks.exe or at.exe to add and modify task schedules

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Adds / modifies Windows certificates

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a Chrome extension

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potentially Suspicious Desktop Background Change Via Registry

Stores files to the Windows start menu directory

Too many similar processes found

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses reg.exe to modify the Windows registry

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

Iir6rxs8r6.exe (PID: 4852 cmdline: "C:\Users\user\Desktop\Iir6rxs8r6.exe" MD5: 2B825EA77E240D2AB6B6695A602CB07C)

cmd.exe (PID: 2364 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2408 cmdline: cmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

reg.exe (PID: 712 cmdline: reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 2348 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5904 cmdline: cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

reg.exe (PID: 6416 cmdline: reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 5972 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2980 cmdline: cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

reg.exe (PID: 3028 cmdline: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 6832 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1620 cmdline: cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

reg.exe (PID: 4216 cmdline: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 3168 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7096 cmdline: cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

reg.exe (PID: 6592 cmdline: reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 2876 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3732 cmdline: cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

reg.exe (PID: 5192 cmdline: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 1164 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2232 cmdline: cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

reg.exe (PID: 6860 cmdline: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 3512 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6436 cmdline: cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

reg.exe (PID: 2756 cmdline: reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 1156 cmdline: C:\Windows\system32\cmd.exe /c rundll32.exe user32.dll,UpdatePerUserSystemParameters MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 524 cmdline: rundll32.exe user32.dll,UpdatePerUserSystemParameters MD5: EF3179D498793BF4234F708D3BE28633)

cmd.exe (PID: 3416 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c start powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6052 cmdline: cmd.exe /c start powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 4064 cmdline: powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4104 cmdline: "C:\Windows\system32\schtasks.exe" /delete /tn Rhsd /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 2496 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\Iir6rxs8r6.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4792 cmdline: cmd.exe /c start ping 127.0.0.1 -n 2 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

PING.EXE (PID: 4832 cmdline: ping 127.0.0.1 -n 2 MD5: 2F46799D79D22AC72C241EC0322B011D)

conhost.exe (PID: 5444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 4332 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1448 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 180 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1616,i,3413580249765337229,1280072705313980885,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhysida		No Attribution	https://blog.talosintelligence.com/rhysida-ransomware/ https://decoded.avast.io/threatresearch/rhysida-ransomware-technical-analysis/ https://detect.fyi/rhysida-ransomware-and-the-detection-opportunities-3599e9a02bb2 https://fourcore.io/blogs/rhysida-ransomware-history-ttp-adversary-emulation https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhysida

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Iir6rxs8r6.exe	JoeSecurity_rhysida	Yara detected Rhysida Ransomware	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5F2FFB7A31DBA078D8F948F77F0FE9B82BEB1559.bin.7C.rhysida	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5F2FFB7A31DBA078D8F948F77F0FE9B82BEB1559.bin.79.rhysida	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: Iir6rxs8r6.exe PID: 4852	JoeSecurity_rhysida	Yara detected Rhysida Ransomware	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\schtasks.exe" /delete /tn Rhsd /f, CommandLine: "C:\Windows\system32\schtasks.exe" /delete /tn Rhsd /f, CommandLine|base64offset|contains: z, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4064, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\schtasks.exe" /delete /tn Rhsd /f, ProcessId: 4104, ProcessName: schtasks.exe

Sigma detected: Suspicious Ping/Del Command Combination

Source: Process started

Author: Ilya Krestinichev: Data: Command: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\Iir6rxs8r6.exe", CommandLine: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\Iir6rxs8r6.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Iir6rxs8r6.exe", ParentImage: C:\Users\user\Desktop\Iir6rxs8r6.exe, ParentProcessId: 4852, ParentProcessName: Iir6rxs8r6.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\Iir6rxs8r6.exe", ProcessId: 2496, ProcessName: cmd.exe

Sigma detected: Potentially Suspicious Desktop Background Change Via Registry

Source: Registry Key set

Author: Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ): Data: Details: C:\Users\Public\bg.jpg, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\reg.exe, ProcessId: 6592, TargetObject: HKEY_CURRENT_USER\Control Panel\Desktop\Wallpaper

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;", CommandLine: powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd.exe /c start powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6052, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;", ProcessId: 4064, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Iir6rxs8r6.exe

ReversingLabs: Detection: 81%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe

Code function: 0_2_0043E021 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptAcquireContextA,

0_2_0043E021

Source: Iir6rxs8r6.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: \??\C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\* source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida&O source: Iir6rxs8r6.exe, 00000000.00000002.3233096131.0000000004A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbu source: Iir6rxs8r6.exe, 00000000.00000002.3229153631.0000000003D42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb%m.h source: Iir6rxs8r6.exe, 00000000.00000002.3225224394.0000000003796000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb6 source: Iir6rxs8r6.exe, 00000000.00000002.3225603623.0000000003810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*2tP source: Iir6rxs8r6.exe, 00000000.00000003.1828765583.000000000010A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: emp/Symbols/winload_prod.pdb/01AB9056EA9380F@ source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2wekyb3d8bbwe\LocalCacher Data\Default\Extensions\nmmhkkq source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidar, source: Iir6rxs8r6.exe, 00000000.00000002.3226682985.0000000003934000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb? source: Iir6rxs8r6.exe, 00000000.00000002.3229153631.0000000003D42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbq,+ source: Iir6rxs8r6.exe, 00000000.00000002.3227633984.0000000003B31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaT source: Iir6rxs8r6.exe, 00000000.00000002.3230224009.0000000003EE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: Iir6rxs8r6.exe, 00000000.00000002.3231065025.0000000004044000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229299015.0000000003DCA000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227092348.00000000039E3000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230644769.0000000003F98000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227242449.0000000003A6A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3224379439.00000000036BD000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3235038394.0000000004C5B000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3226196423.000000000388D000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3233775780.0000000004B07000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230224009.0000000003EE6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3234342821.0000000004BA7000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3225224394.0000000003796000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229117500.0000000003D30000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3232582558.00000000041D5000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229557865.0000000003E29000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3226649501.0000000003922000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227994671.0000000003BE2000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3228706934.0000000003C77000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3233254008.0000000004A74000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229153631.0000000003D42000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3225053931.000000000375A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3231485189.0000000004106000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3225182842.0000000003784000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227633984.0000000003B31000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3225603623.0000000003810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: Iir6rxs8r6.exe, 00000000.00000003.1828765583.000000000010A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1829153779.000000000010D000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\CriticalBreachDetected.pdfntdesk\AppDa@ source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: a\Application Data\Temp\Symbols\ntkrnlmp.pdb\CriticalBreachDetected.pdf31cation Dn source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DaC:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\kies\pData\\Apps_{9a386491-5394-47a0-a408-e4e3a9d60139}\e6IT source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2s/fro source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaa source: Iir6rxs8r6.exe, 00000000.00000002.3226196423.000000000388D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: Iir6rxs8r6.exe, 00000000.00000002.3225603623.0000000003810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidaI source: Iir6rxs8r6.exe, 00000000.00000002.3229017243.0000000003D10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaY source: Iir6rxs8r6.exe, 00000000.00000002.3231485189.0000000004106000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ation Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAS source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ad_prod.pdbe\AC\INetCookies\ESEFta\Appli source: Iir6rxs8r6.exe, 00000000.00000003.1866632282.00000000000FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb6<k source: Iir6rxs8r6.exe, 00000000.00000002.3226649501.0000000003922000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbM, source: Iir6rxs8r6.exe, 00000000.00000002.3227633984.0000000003B31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidalVA source: Iir6rxs8r6.exe, 00000000.00000002.3234928870.0000000004C37000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DaC:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\RX_INSTALL\_locales\zh_CN\alState\tory\ookies\a78ba80c-bc89-4102-a032-406d11845944}\f5r source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/ntkrnlmp.pdb.rhysidadf/Application Data/Application Da source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ation Data\Temp\Symbols\ntkrnlmp.pdb\68A17FA7 source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidag source: Iir6rxs8r6.exe, 00000000.00000002.3228706934.0000000003C77000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidai,3 source: Iir6rxs8r6.exe, 00000000.00000002.3227633984.0000000003B31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida source: Iir6rxs8r6.exe, 00000000.00000002.3227092348.00000000039E3000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227203205.0000000003A48000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227595840.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3226366114.00000000038BD000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229709791.0000000003E6F000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3234379156.0000000004BC1000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3234928870.0000000004C37000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3231528985.0000000004118000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3233718568.0000000004AF5000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3228638643.0000000003C4D000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3233096131.0000000004A50000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3232386217.00000000041B3000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230688687.0000000003FAA000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3226682985.0000000003934000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230936905.000000000400D000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3228050105.0000000003BF4000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229017243.0000000003D10000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230257972.0000000003EF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: Iir6rxs8r6.exe, 00000000.00000003.1828765583.000000000010A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb++ source: Iir6rxs8r6.exe, 00000000.00000002.3229557865.0000000003E29000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbs source: Iir6rxs8r6.exe, 00000000.00000002.3226196423.000000000388D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidah source: Iir6rxs8r6.exe, 00000000.00000002.3227092348.00000000039E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n Data/Temp/Symbols/winload_prod.pdb/01AB905 source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbB source: Iir6rxs8r6.exe, 00000000.00000002.3230224009.0000000003EE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: Iir6rxs8r6.exe, 00000000.00000002.3231065025.0000000004044000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229299015.0000000003DCA000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227092348.00000000039E3000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230644769.0000000003F98000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227242449.0000000003A6A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3224379439.00000000036BD000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3235038394.0000000004C5B000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3226196423.000000000388D000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3233775780.0000000004B07000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230224009.0000000003EE6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3234342821.0000000004BA7000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3225224394.0000000003796000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229117500.0000000003D30000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3232582558.00000000041D5000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229557865.0000000003E29000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3226649501.0000000003922000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227994671.0000000003BE2000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3228706934.0000000003C77000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3233254008.0000000004A74000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229153631.0000000003D42000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3225053931.000000000375A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3231485189.0000000004106000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3225182842.0000000003784000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227633984.0000000003B31000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3225603623.0000000003810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Symbols\winload_prod.pdb\01AB9056EA9380F7164b source: Iir6rxs8r6.exe, 00000000.00000003.1828765583.000000000010A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2AC2n source: Iir6rxs8r6.exe, 00000000.00000003.1828765583.000000000010A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A58 source: Iir6rxs8r6.exe, 00000000.00000003.1828765583.000000000010A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb} source: Iir6rxs8r6.exe, 00000000.00000002.3230644769.0000000003F98000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbG source: Iir6rxs8r6.exe, 00000000.00000002.3234342821.0000000004BA7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Symbols\winload_prod.pdb\01AB9056EA9380F7164^ source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ols/ntkrnlmp.pdbs32 source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbN source: Iir6rxs8r6.exe, 00000000.00000002.3227092348.00000000039E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ols/ntkrnlmp.pdbhDe source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Symbols\winload_prod.pdb\01AB9056EA9380F7164 source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida[j source: Iir6rxs8r6.exe, 00000000.00000002.3233254008.0000000004A74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831O source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida$ source: Iir6rxs8r6.exe, 00000000.00000002.3232582558.00000000041D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb;] source: Iir6rxs8r6.exe, 00000000.00000002.3231065025.0000000004044000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb3ta source: Iir6rxs8r6.exe, 00000000.00000003.1895165991.0000000000108000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb[ source: Iir6rxs8r6.exe, 00000000.00000002.3234342821.0000000004BA7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb^ source: Iir6rxs8r6.exe, 00000000.00000002.3225182842.0000000003784000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DaC:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\pData\te\er\DOMStore\1/CriticalBreachDetected.pdftrass source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ation Data\Temp\Symbols\ntkrnlmp.pdb\68A17FA source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbd source: Iir6rxs8r6.exe, 00000000.00000002.3225603623.0000000003810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbf source: Iir6rxs8r6.exe, 00000000.00000002.3224379439.00000000036BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida4 source: Iir6rxs8r6.exe, 00000000.00000002.3227092348.00000000039E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb%ss source: Iir6rxs8r6.exe, 00000000.00000002.3225053931.000000000375A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\w source: Iir6rxs8r6.exe, 00000000.00000003.1828765583.000000000010A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\CriticalBreachDetected.pdfocal\Applica source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida source: Iir6rxs8r6.exe, 00000000.00000002.3231065025.0000000004044000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227092348.00000000039E3000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230644769.0000000003F98000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227242449.0000000003A6A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3235038394.0000000004C5B000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3226196423.000000000388D000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3233775780.0000000004B07000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230224009.0000000003EE6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3234342821.0000000004BA7000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229117500.0000000003D30000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3232582558.00000000041D5000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229557865.0000000003E29000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3226649501.0000000003922000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227994671.0000000003BE2000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3228706934.0000000003C77000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3233254008.0000000004A74000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3231485189.0000000004106000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227633984.0000000003B31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbl source: Iir6rxs8r6.exe, 00000000.00000002.3225182842.0000000003784000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*a/ source: Iir6rxs8r6.exe, 00000000.00000003.1895165991.0000000000108000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ad_prod.pdb.rhysida source: Iir6rxs8r6.exe, 00000000.00000003.1828765583.000000000010A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File opened: C:\Users\All Users\Application Data\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5}\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File opened: C:\Users\All Users\.curlrc.rhysida	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File opened: C:\Users\All Users\Application Data\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File opened: C:\Users\All Users\Application Data\Adobe\ARM\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File opened: C:\Users\All Users\Application Data\Adobe\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File opened: C:\Users\All Users\Application Data\Adobe\ARM\Acrobat_23.006.20320\CriticalBreachDetected.pdf	Jump to behavior

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 4x nop then jmp 00430550h	0_2_0041DFD0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 4x nop then lea r8, qword ptr [0000000000460600h]	0_2_00428AE0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 4x nop then lea r8, qword ptr [0000000000461040h]	0_2_0042BA90
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 4x nop then lea r8, qword ptr [0000000000461660h]	0_2_0042CC50

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2

Source: Joe Sandbox View	IP Address: 23.51.56.185 23.51.56.185
Source: Joe Sandbox View	IP Address: 52.5.13.197 52.5.13.197
Source: Joe Sandbox View	IP Address: 96.17.64.189 96.17.64.189

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo2.adobe.comConnection: keep-aliveAccept: application/jsonAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: OPTIONS /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-aliveAccept: /Access-Control-Request-Method: GETAccess-Control-Request-Headers: x-adobe-uuid,x-adobe-uuid-type,x-api-keyOrigin: https://rna-resource.acrobat.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: c583ad55-e27a-405e-ae1a-c48b4361aa9dx-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.56.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.56.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.56.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.56.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.56.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.56.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.56.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.56.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.56.185
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe

File created: C:\Users\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\CriticalBreachDetected.pdf

Jump to behavior

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo2.adobe.comConnection: keep-aliveAccept: application/jsonAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: c583ad55-e27a-405e-ae1a-c48b4361aa9dx-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5F2FFB7A31DBA078D8F948F77F0FE9B82BEB1559.bin.7C.rhysida, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5F2FFB7A31DBA078D8F948F77F0FE9B82BEB1559.bin.79.rhysida, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Yara detected Rhysida Ransomware

Source: Yara match	File source: Iir6rxs8r6.exe, type: SAMPLE
Source: Yara match	File source: Process Memory Space: Iir6rxs8r6.exe PID: 4852, type: MEMORYSTR

Changes the wallpaper picture

Source: C:\Windows\System32\reg.exe

Key value created or modified: HKEY_CURRENT_USER\Control Panel\Desktop Wallpaper C:\Users\Public\bg.jpg

Writes many files with high entropy

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\$WinREAgent\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\$WinREAgent\Scratch\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Adobe\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Adobe\ARM\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5}\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Powershell\MSFT_MpPreference.cdxml.rhysida entropy: 7.99870958536	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Powershell\MSFT_MpSignature.cdxml.rhysida entropy: 7.99094743776	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ru-RU\ProtectionManagement.dll.mui.rhysida entropy: 7.99684266032	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sr-Cyrl-BA\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sr-Cyrl-RS\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sr-Latn-RS\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sr-Cyrl-RS\mpuxagent.dll.mui.rhysida entropy: 7.99537873932	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sr-Cyrl-BA\mpuxagent.dll.mui.rhysida entropy: 7.99555688285	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sr-Latn-RS\mpuxagent.dll.mui.rhysida entropy: 7.99465219564	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sr-Latn-RS\MpAsDesc.dll.mui.rhysida entropy: 7.99734848924	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\en-GB\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\en-US\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\en-GB\mpasdesc.dll.mui.rhysida entropy: 7.99644351166	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\en-US\MpAsDesc.dll.mui.rhysida entropy: 7.99717511438	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-CN\ProtectionManagement.dll.mui.rhysida entropy: 7.99562104273	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-TW\ProtectionManagement.dll.mui.rhysida entropy: 7.99565181982	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\az-Latn-AZ\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bs-Latn-BA\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\az-Latn-AZ\mpuxagent.dll.mui.rhysida entropy: 7.99532591327	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bs-Latn-BA\mpuxagent.dll.mui.rhysida entropy: 7.99503765239	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ca-ES-valencia\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Catalogs\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ca-ES-valencia\mpuxagent.dll.mui.rhysida entropy: 7.99445642129	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Drivers\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\de-DE\ProtectionManagement.dll.mui.rhysida entropy: 7.99700587417	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-US\ProtectionManagement.dll.mui.rhysida entropy: 7.99677588084	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-ES\ProtectionManagement.dll.mui.rhysida entropy: 7.99757704981	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-FR\ProtectionManagement.dll.mui.rhysida entropy: 7.99725827095	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\it-IT\ProtectionManagement.dll.mui.rhysida entropy: 7.99724408727	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ja-JP\ProtectionManagement.dll.mui.rhysida entropy: 7.99679699777	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ko-KR\ProtectionManagement.dll.mui.rhysida entropy: 7.99602606196	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Microsoft-Windows-Windows Defender.man.rhysida entropy: 7.99881596473	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sl-SI\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Microsoft-Antimalware-Service.man.rhysida entropy: 7.99482899154	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ru-RU\MpEvMsg.dll.mui.rhysida entropy: 7.99665448395	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ru-RU\mpuxagent.dll.mui.rhysida entropy: 7.99478772255	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sq-AL\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Powershell\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sk-SK\MpAsDesc.dll.mui.rhysida entropy: 7.99727762898	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sl-SI\mpuxagent.dll.mui.rhysida entropy: 7.99440876817	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sl-SI\MpAsDesc.dll.mui.rhysida entropy: 7.99752223717	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sv-SE\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pl-PL\mpuxagent.dll.mui.rhysida entropy: 7.99431875528	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ta-IN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Powershell\MSFT_MpPreference.cdxml.rhysida entropy: 7.99878036717	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sq-AL\mpuxagent.dll.mui.rhysida entropy: 7.99577800027	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sv-SE\MpEvMsg.dll.mui.rhysida entropy: 7.9971654064	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sv-SE\mpuxagent.dll.mui.rhysida entropy: 7.99513016149	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pt-BR\ProtectionManagement.dll.mui.rhysida entropy: 7.99722731586	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\te-IN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ta-IN\mpuxagent.dll.mui.rhysida entropy: 7.99509851898	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Powershell\MSFT_MpSignature.cdxml.rhysida entropy: 7.99050270072	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\th-TH\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ru-RU\ProtectionManagement.dll.mui.rhysida entropy: 7.99726126292	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\te-IN\mpuxagent.dll.mui.rhysida entropy: 7.99485614652	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\tr-TR\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sr-Cyrl-BA\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sv-SE\MpAsDesc.dll.mui.rhysida entropy: 7.99730249902	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sr-Cyrl-RS\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sr-Cyrl-BA\mpuxagent.dll.mui.rhysida entropy: 7.99468535874	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\th-TH\mpuxagent.dll.mui.rhysida entropy: 7.993831331	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sr-Latn-RS\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\tt-RU\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sr-Cyrl-RS\mpuxagent.dll.mui.rhysida entropy: 7.99440215623	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\tr-TR\MpEvMsg.dll.mui.rhysida entropy: 7.99616172123	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sr-Latn-RS\mpuxagent.dll.mui.rhysida entropy: 7.99473185535	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\tr-TR\mpuxagent.dll.mui.rhysida entropy: 7.99501872919	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sr-Latn-RS\MpAsDesc.dll.mui.rhysida entropy: 7.99645616426	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ug-CN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\en-GB\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\th-TH\MpAsDesc.dll.mui.rhysida entropy: 7.99680350853	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\en-US\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\uk-UA\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\en-US\MpAsDesc.dll.mui.rhysida entropy: 7.99664814174	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\tt-RU\mpuxagent.dll.mui.rhysida entropy: 7.99433708517	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\en-GB\mpasdesc.dll.mui.rhysida entropy: 7.99643220993	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ur-PK\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\uk-UA\mpuxagent.dll.mui.rhysida entropy: 7.99501898144	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-CN\ProtectionManagement.dll.mui.rhysida entropy: 7.99609282274	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-TW\ProtectionManagement.dll.mui.rhysida entropy: 7.99567621266	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\uk-UA\MpAsDesc.dll.mui.rhysida entropy: 7.99728016331	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\vi-VN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\19\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ur-PK\mpuxagent.dll.mui.rhysida entropy: 7.99405191119	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\vi-VN\mpuxagent.dll.mui.rhysida entropy: 7.99432185958	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-CN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sk-SK\mpuxagent.dll.mui.rhysida entropy: 7.99459724664	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-TW\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-CN\MpEvMsg.dll.mui.rhysida entropy: 7.99497592926	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-CN\mpuxagent.dll.mui.rhysida entropy: 7.99077670268	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-TW\MpAsDesc.dll.mui.rhysida entropy: 7.99424480577	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-TW\mpuxagent.dll.mui.rhysida entropy: 7.99078171595	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ru-RU\MpEvMsg.dll.mui.rhysida entropy: 7.99711872708	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Quarantine\Entries\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sl-SI\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ru-RU\MpAsDesc.dll.mui.rhysida entropy: 7.99737838327	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\01\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ru-RU\mpuxagent.dll.mui.rhysida entropy: 7.99555748222	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Quarantine\ResourceData\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\de-DE\MpAsDesc.dll.mui.rhysida entropy: 7.99746986488	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Quarantine\ResourceData\E3\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sq-AL\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pt-PT\mpuxagent.dll.mui.rhysida entropy: 7.9938980416	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sl-SI\mpuxagent.dll.mui.rhysida entropy: 7.99519514759	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Quarantine\Resources\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sl-SI\MpAsDesc.dll.mui.rhysida entropy: 7.99737574302	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pt-BR\MpEvMsg.dll.mui.rhysida entropy: 7.99690228611	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sv-SE\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Quarantine\Resources\E3\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sk-SK\MpAsDesc.dll.mui.rhysida entropy: 7.99728719052	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pl-PL\mpuxagent.dll.mui.rhysida entropy: 7.99484411477	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\04\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pl-PL\MpAsDesc.dll.mui.rhysida entropy: 7.99743784275	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\BackupStore\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ta-IN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nl-NL\mpuxagent.dll.mui.rhysida entropy: 7.99556701346	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sv-SE\MpEvMsg.dll.mui.rhysida entropy: 7.99738049085	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ne-NP\mpuxagent.dll.mui.rhysida entropy: 7.99450933913	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sq-AL\mpuxagent.dll.mui.rhysida entropy: 7.99506887833	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\06\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sv-SE\mpuxagent.dll.mui.rhysida entropy: 7.99396997847	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mt-MT\mpuxagent.dll.mui.rhysida entropy: 7.99468899702	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\te-IN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\ReportLatency\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ta-IN\mpuxagent.dll.mui.rhysida entropy: 7.99540875184	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mr-IN\mpuxagent.dll.mui.rhysida entropy: 7.99598794999	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\th-TH\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\tr-TR\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\th-TH\MpAsDesc.dll.mui.rhysida entropy: 7.99715122033	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\th-TH\mpuxagent.dll.mui.rhysida entropy: 7.99434133206	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cy-GB\mpuxagent.dll.mui.rhysida entropy: 7.994551777	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpasbase.vdm.rhysida entropy: 7.9977589521	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\tt-RU\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\tr-TR\mpuxagent.dll.mui.rhysida entropy: 7.99429081447	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\tr-TR\MpEvMsg.dll.mui.rhysida entropy: 7.99677743888	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-TW\MpEvMsg.dll.mui.rhysida entropy: 7.99513794124	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ca-ES\MpAsDesc.dll.mui.rhysida entropy: 7.99730360919	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\Data\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ug-CN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\uk-UA\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\tt-RU\mpuxagent.dll.mui.rhysida entropy: 7.99521447666	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ur-PK\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\uk-UA\MpAsDesc.dll.mui.rhysida entropy: 7.9972554754	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\uk-UA\mpuxagent.dll.mui.rhysida entropy: 7.9958627018	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-CN\MpAsDesc.dll.mui.rhysida entropy: 7.99486531326	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bg-BG\MpAsDesc.dll.mui.rhysida entropy: 7.997020429	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\vi-VN\MpAsDesc.dll.mui.rhysida entropy: 7.99743382076	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\vi-VN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ur-PK\mpuxagent.dll.mui.rhysida entropy: 7.994758511	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Temp\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-CN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ug-CN\mpuxagent.dll.mui.rhysida entropy: 7.99459039385	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-TW\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\tr-TR\MpAsDesc.dll.mui.rhysida entropy: 7.99716326248	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\af-ZA\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\te-IN\mpuxagent.dll.mui.rhysida entropy: 7.9946730321	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ar-SA\MpAsDesc.dll.mui.rhysida entropy: 7.99708325407	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-GB\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-CN\mpuxagent.dll.mui.rhysida entropy: 7.99135719788	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sv-SE\MpAsDesc.dll.mui.rhysida entropy: 7.99706496808	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\am-ET\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sk-SK\mpuxagent.dll.mui.rhysida entropy: 7.99485191424	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\vi-VN\mpuxagent.dll.mui.rhysida entropy: 7.99452236261	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ru-RU\MpAsDesc.dll.mui.rhysida entropy: 7.99720696498	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\af-ZA\mpuxagent.dll.mui.rhysida entropy: 7.99529441216	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pt-PT\mpuxagent.dll.mui.rhysida entropy: 7.99429024291	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man.rhysida entropy: 7.9983131622	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ar-SA\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-GB\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-TW\mpuxagent.dll.mui.rhysida entropy: 7.99117847865	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pt-BR\MpEvMsg.dll.mui.rhysida entropy: 7.99669960775	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man.rhysida entropy: 7.99954566432	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\am-ET\mpuxagent.dll.mui.rhysida entropy: 7.99323735827	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pl-PL\MpAsDesc.dll.mui.rhysida entropy: 7.99771293633	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\as-IN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.bk.rhysida entropy: 7.998880008	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-CN\MpEvMsg.dll.mui.rhysida entropy: 7.99544503366	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.rhysida entropy: 7.99887922229	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\nl-NL\mpuxagent.dll.mui.rhysida entropy: 7.99466361632	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ne-NP\mpuxagent.dll.mui.rhysida entropy: 7.99490553125	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-TW\MpAsDesc.dll.mui.rhysida entropy: 7.9946883099	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mt-MT\mpuxagent.dll.mui.rhysida entropy: 7.99435525018	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bg-BG\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mr-IN\mpuxagent.dll.mui.rhysida entropy: 7.99533746423	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ScenarioShutdownLogger\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ar-SA\mpuxagent.dll.mui.rhysida entropy: 7.99434619628	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\Diagtrack-Listener.etl.rhysida entropy: 7.99928348011	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\as-IN\mpuxagent.dll.mui.rhysida entropy: 7.99422772899	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ml-IN\mpuxagent.dll.mui.rhysida entropy: 7.99600050847	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_alternativeTrace\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bn-IN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_aot\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bg-BG\mpuxagent.dll.mui.rhysida entropy: 7.99425936546	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\lt-LT\mpuxagent.dll.mui.rhysida entropy: 7.99432032333	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_diag\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpasbase.lkg.rhysida entropy: 7.99764892319	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\kok-IN\mpuxagent.dll.mui.rhysida entropy: 7.99495889796	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_miniTrace\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ca-ES\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Diagnosis\TimeTravelDebuggingStorage\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bn-IN\mpuxagent.dll.mui.rhysida entropy: 7.99525211731	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Provisioning\AssetCache\CellularUx\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cs-CZ\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ca-ES\mpuxagent.dll.mui.rhysida entropy: 7.99405699263	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cy-GB\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cs-CZ\MpEvMsg.dll.mui.rhysida entropy: 7.99645831329	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cs-CZ\MpAsDesc.dll.mui.rhysida entropy: 7.99673217749	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\da-DK\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\NisBackup\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\de-DE\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\da-DK\MpAsDesc.dll.mui.rhysida entropy: 7.9971852033	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpavdlta.vdm.rhysida entropy: 7.99796669836	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\da-DK\MpEvMsg.dll.mui.rhysida entropy: 7.99668638396	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\DLPCache\FileEvidence\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\el-GR\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpavbase.lkg.rhysida entropy: 7.99810375548	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\de-DE\MpEvMsg.dll.mui.rhysida entropy: 7.99614454977	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpavdlta.lkg.rhysida entropy: 7.99983582376	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-GB\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\de-DE\mpuxagent.dll.mui.rhysida entropy: 7.99523139836	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\DLPCache\NetworkFilesMappingStubs\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-US\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpasdlta.vdm.rhysida entropy: 7.99967556132	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\el-GR\mpuxagent.dll.mui.rhysida entropy: 7.99593315627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Network Inspection System\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\el-GR\MpEvMsg.dll.mui.rhysida entropy: 7.99693950864	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Network Inspection System\Support\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-ES\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpasdlta.lkg.rhysida entropy: 7.99988440106	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-US\MpEvMsg.dll.mui.rhysida entropy: 7.9967667225	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-MX\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\af-ZA\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-ES\MpAsDesc.dll.mui.rhysida entropy: 7.99751903879	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\am-ET\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\et-EE\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ar-SA\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\as-IN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-ES\MpEvMsg.dll.mui.rhysida entropy: 7.99721669818	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\eu-ES\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\am-ET\mpuxagent.dll.mui.rhysida entropy: 7.99290969193	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-MX\mpuxagent.dll.mui.rhysida entropy: 7.9949975385	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\af-ZA\mpuxagent.dll.mui.rhysida entropy: 7.9944707034	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\et-EE\MpAsDesc.dll.mui.rhysida entropy: 7.99674771436	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bg-BG\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fa-IR\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bn-IN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-US\MpAsDesc.dll.mui.rhysida entropy: 7.99725395488	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\as-IN\mpuxagent.dll.mui.rhysida entropy: 7.99457565266	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fi-FI\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ca-ES\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fil-PH\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bn-IN\mpuxagent.dll.mui.rhysida entropy: 7.99491768815	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fa-IR\mpuxagent.dll.mui.rhysida entropy: 7.99480203397	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cs-CZ\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fi-FI\MpAsDesc.dll.mui.rhysida entropy: 7.99726881725	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cy-GB\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ca-ES\mpuxagent.dll.mui.rhysida entropy: 7.99470410302	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fi-FI\mpuxagent.dll.mui.rhysida entropy: 7.99526985268	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-CA\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Catalogs\IGD.CAT.rhysida entropy: 7.99506462908	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fil-PH\mpuxagent.dll.mui.rhysida entropy: 7.99516021232	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\da-DK\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-FR\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cs-CZ\MpEvMsg.dll.mui.rhysida entropy: 7.996652098	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\eu-ES\mpuxagent.dll.mui.rhysida entropy: 7.99544467925	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\de-DE\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-CA\MpAsDesc.dll.mui.rhysida entropy: 7.99798870432	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cs-CZ\mpuxagent.dll.mui.rhysida entropy: 7.99446430048	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-FR\MpAsDesc.dll.mui.rhysida entropy: 7.99774075555	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cs-CZ\MpAsDesc.dll.mui.rhysida entropy: 7.99703393689	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ga-IE\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\el-GR\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-FR\MpEvMsg.dll.mui.rhysida entropy: 7.99701822304	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-GB\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-FR\mpuxagent.dll.mui.rhysida entropy: 7.99458418649	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-US\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-ES\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-MX\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\et-EE\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\eu-ES\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\da-DK\mpuxagent.dll.mui.rhysida entropy: 7.9950404542	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\de-DE\mpuxagent.dll.mui.rhysida entropy: 7.99519455615	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\el-GR\MpEvMsg.dll.mui.rhysida entropy: 7.99764765448	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fa-IR\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fi-FI\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\et-EE\mpuxagent.dll.mui.rhysida entropy: 7.99492019419	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\et-EE\MpAsDesc.dll.mui.rhysida entropy: 7.99697640606	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fa-IR\mpuxagent.dll.mui.rhysida entropy: 7.99434877241	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fil-PH\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-ES\mpuxagent.dll.mui.rhysida entropy: 7.99513532017	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-CA\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-MX\mpuxagent.dll.mui.rhysida entropy: 7.99451233948	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fi-FI\MpEvMsg.dll.mui.rhysida entropy: 7.99637865836	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fi-FI\MpAsDesc.dll.mui.rhysida entropy: 7.99672749293	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-FR\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ga-IE\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\gd-GB\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fil-PH\mpuxagent.dll.mui.rhysida entropy: 7.99533880575	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-CA\mpuxagent.dll.mui.rhysida entropy: 7.99537385077	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-FR\mpuxagent.dll.mui.rhysida entropy: 7.99483394625	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\gl-ES\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ga-IE\mpuxagent.dll.mui.rhysida entropy: 7.99436513712	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-FR\MpEvMsg.dll.mui.rhysida entropy: 7.99716970129	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\gu-IN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-CA\MpAsDesc.dll.mui.rhysida entropy: 7.99767607139	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-US\mpuxagent.dll.mui.rhysida entropy: 7.99489677481	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\he-IL\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\gl-ES\mpuxagent.dll.mui.rhysida entropy: 7.99491681901	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hi-IN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\he-IL\MpAsDesc.dll.mui.rhysida entropy: 7.99638449758	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hr-HR\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-ES\MpAsDesc.dll.mui.rhysida entropy: 7.99727066256	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\gu-IN\mpuxagent.dll.mui.rhysida entropy: 7.99514310274	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hu-HU\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-GB\MpAsDesc.dll.mui.rhysida entropy: 7.99737840991	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hi-IN\mpuxagent.dll.mui.rhysida entropy: 7.99551229807	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\id-ID\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\07\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\08\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\15\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\17\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\20\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\21\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5F2FFB7A31DBA078D8F948F77F0FE9B82BEB1559.bin.E6.rhysida entropy: 7.99719406725	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5F2FFB7A31DBA078D8F948F77F0FE9B82BEB1559.bin.A0.rhysida entropy: 7.9998722731	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5F2FFB7A31DBA078D8F948F77F0FE9B82BEB1559.bin.6C.rhysida entropy: 7.99627514801	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5F2FFB7A31DBA078D8F948F77F0FE9B82BEB1559.bin.01.rhysida entropy: 7.9998471054	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Package Cache\{D5D19E2F-7189-42FE-8103-92CD1FA457C2}v14.36.32532\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Package Cache\{D5D19E2F-7189-42FE-8103-92CD1FA457C2}v14.36.32532\packages\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A3CECAC7-AFEC-4136-AD26-4F02273A588C\en-us.16\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A3CECAC7-AFEC-4136-AD26-4F02273A588C\x-none.16\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A3CECAC7-AFEC-4136-AD26-4F02273A588C\en-us.16\stream.x86.en-us.dat.cat.rhysida entropy: 7.99778181088	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A3CECAC7-AFEC-4136-AD26-4F02273A588C\en-us.16\stream.x86.en-us.db.rhysida entropy: 7.99957255795	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\kn-IN\mpuxagent.dll.mui.rhysida entropy: 7.99371304586	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A3CECAC7-AFEC-4136-AD26-4F02273A588C\en-us.16\stream.x86.en-us.man.dat.rhysida entropy: 7.99979234419	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A3CECAC7-AFEC-4136-AD26-4F02273A588C\x-none.16\stream.x86.x-none.db.rhysida entropy: 7.99555479699	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ja-JP\mpuxagent.dll.mui.rhysida entropy: 7.99269250286	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\it-IT\MpEvMsg.dll.mui.rhysida entropy: 7.99694043062	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.rhysida entropy: 7.99843672143	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\id-ID\MpAsDesc.dll.mui.rhysida entropy: 7.99719527424	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.en-us.xml.rhysida entropy: 7.99295748743	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hr-HR\mpuxagent.dll.mui.rhysida entropy: 7.99497708679	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml.rhysida entropy: 7.99842984622	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\he-IL\MpAsDesc.dll.mui.rhysida entropy: 7.99701215971	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.rhysida entropy: 7.99266919769	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.rhysida entropy: 7.9982801707	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml.rhysida entropy: 7.99861569001	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ga-IE\mpuxagent.dll.mui.rhysida entropy: 7.99488033037	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml.rhysida entropy: 7.99350438134	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-CA\mpuxagent.dll.mui.rhysida entropy: 7.99518316431	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.rhysida entropy: 7.99976936999	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fi-FI\MpEvMsg.dll.mui.rhysida entropy: 7.99653938461	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.rhysida entropy: 7.99825350101	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.rhysida entropy: 7.99821015813	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\et-EE\mpuxagent.dll.mui.rhysida entropy: 7.99325571153	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-ES\mpuxagent.dll.mui.rhysida entropy: 7.99496247448	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A3CECAC7-AFEC-4136-AD26-4F02273A588C\x-none.16\MasterDescriptor.x-none.xml.rhysida entropy: 7.99548551978	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.es-es.xml.rhysida entropy: 7.99240703452	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-US\mpuxagent.dll.mui.rhysida entropy: 7.99373825449	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-GB\MpAsDesc.dll.mui.rhysida entropy: 7.99696991494	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\da-DK\mpuxagent.dll.mui.rhysida entropy: 7.99452442802	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cs-CZ\mpuxagent.dll.mui.rhysida entropy: 7.99431635806	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml.rhysida entropy: 7.99139121076	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Catalogs\IGD.CAT.rhysida entropy: 7.99615962081	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64ww.msi.16.x-none.xml.rhysida entropy: 7.99942806098	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A3CECAC7-AFEC-4136-AD26-4F02273A588C\en-us.16\MasterDescriptor.en-us.xml.rhysida entropy: 7.99390288283	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.rhysida entropy: 7.9987489749	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml.rhysida entropy: 7.99524360855	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmui.msi.16.en-us.xml.rhysida entropy: 7.99663756122	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.rhysida entropy: 7.99705546808	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A3CECAC7-AFEC-4136-AD26-4F02273A588C\x-none.16\stream.x86.x-none.dat.cat.rhysida entropy: 7.99969875527	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_DeviceProvisioning_2023_10_4_9_46_43.etl.rhysida entropy: 7.99900751057	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_DeviceProvisioning_2023_10_3_8_56_48.etl.rhysida entropy: 7.9993662658	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gd-GB\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A3CECAC7-AFEC-4136-AD26-4F02273A588C\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{0F4F15B9-002F-484A-961E-DB92D12569B3}\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-MX\MpAsDesc.dll.mui.rhysida entropy: 7.9975182446	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{0F4F15B9-002F-484A-961E-DB92D12569B3}\mpavdlta.vdm.rhysida entropy: 7.99878567564	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gl-ES\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{0F4F15B9-002F-484A-961E-DB92D12569B3}\mpasdlta.vdm.rhysida entropy: 7.99976462955	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gu-IN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{0F4F15B9-002F-484A-961E-DB92D12569B3}\mpavbase.vdm.rhysida entropy: 7.99805142403	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gd-GB\mpuxagent.dll.mui.rhysida entropy: 7.99586908002	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{0F4F15B9-002F-484A-961E-DB92D12569B3}\mpasbase.vdm.rhysida entropy: 7.99775966159	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gl-ES\mpuxagent.dll.mui.rhysida entropy: 7.99545514258	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.lyncmui.msi.16.en-us.xml.rhysida entropy: 7.99196811304	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\he-IL\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml.rhysida entropy: 7.99781175221	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gu-IN\mpuxagent.dll.mui.rhysida entropy: 7.99593920737	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-GB\mpuxagent.dll.mui.rhysida entropy: 7.9944479888	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hi-IN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\he-IL\mpuxagent.dll.mui.rhysida entropy: 7.99214170757	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hr-HR\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hi-IN\mpuxagent.dll.mui.rhysida entropy: 7.99432082717	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\el-GR\MpAsDesc.dll.mui.rhysida entropy: 7.99790015646	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hu-HU\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hr-HR\MpAsDesc.dll.mui.rhysida entropy: 7.99750611602	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-GB\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\id-ID\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hu-HU\MpAsDesc.dll.mui.rhysida entropy: 7.99766247958	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hu-HU\MpEvMsg.dll.mui.rhysida entropy: 7.99644588016	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hu-HU\mpuxagent.dll.mui.rhysida entropy: 7.99489589804	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\is-IS\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-GB\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\it-IT\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\is-IS\mpuxagent.dll.mui.rhysida entropy: 7.99488417083	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\id-ID\mpuxagent.dll.mui.rhysida entropy: 7.99437163803	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ja-JP\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_Autopilot_2023_10_3_9_59_39.etl.rhysida entropy: 7.99972445054	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\it-IT\mpuxagent.dll.mui.rhysida entropy: 7.99499442145	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_Autopilot_2023_10_3_9_57_25.etl.rhysida entropy: 7.99975205593	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\it-IT\MpAsDesc.dll.mui.rhysida entropy: 7.99768063153	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ka-GE\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ja-JP\MpAsDesc.dll.mui.rhysida entropy: 7.99599256484	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\de-DE\MpAsDesc.dll.mui.rhysida entropy: 7.99752854245	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\kk-KZ\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\az-Latn-AZ\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ja-JP\MpEvMsg.dll.mui.rhysida entropy: 7.99585798694	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\az-Latn-AZ\mpuxagent.dll.mui.rhysida entropy: 7.99443476423	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\km-KH\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bs-Latn-BA\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\kn-IN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ca-ES-valencia\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ka-GE\mpuxagent.dll.mui.rhysida entropy: 7.99405328584	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bs-Latn-BA\mpuxagent.dll.mui.rhysida entropy: 7.99438186606	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\km-KH\mpuxagent.dll.mui.rhysida entropy: 7.99455566899	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Catalogs\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\kk-KZ\mpuxagent.dll.mui.rhysida entropy: 7.99499458627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ca-ES-valencia\mpuxagent.dll.mui.rhysida entropy: 7.99458238861	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ko-KR\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cy-GB\mpuxagent.dll.mui.rhysida entropy: 7.99491858064	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\kok-IN\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Drivers\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ko-KR\mpuxagent.dll.mui.rhysida entropy: 7.992865638	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\de-DE\ProtectionManagement.dll.mui.rhysida entropy: 7.99736498029	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ko-KR\MpEvMsg.dll.mui.rhysida entropy: 7.99474453405	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-US\ProtectionManagement.dll.mui.rhysida entropy: 7.99742365958	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hr-HR\MpAsDesc.dll.mui.rhysida entropy: 7.99756413133	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ko-KR\MpAsDesc.dll.mui.rhysida entropy: 7.9957728583	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-ES\ProtectionManagement.dll.mui.rhysida entropy: 7.99743774414	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hr-HR\mpuxagent.dll.mui.rhysida entropy: 7.99397756094	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\lb-LU\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-FR\ProtectionManagement.dll.mui.rhysida entropy: 7.99733333149	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hu-HU\MpEvMsg.dll.mui.rhysida entropy: 7.99708783612	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ca-ES\MpAsDesc.dll.mui.rhysida entropy: 7.99749242023	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ja-JP\ProtectionManagement.dll.mui.rhysida entropy: 7.9959214806	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\is-IS\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\lo-LA\CriticalBreachDetected.pdf entropy: 7.99107928627	Jump to dropped file
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\it-IT\ProtectionManagement.dll.mui.rhysida entropy: 7.99750560067	Jump to dropped file

Source: cmd.exe

Process created: 42

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_004258B0	0_2_004258B0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0043E470	0_2_0043E470
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0043D470	0_2_0043D470
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0042D340	0_2_0042D340
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0044A870	0_2_0044A870
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0041B020	0_2_0041B020
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_004298E0	0_2_004298E0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_004240E0	0_2_004240E0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0043D0E0	0_2_0043D0E0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0043F0B0	0_2_0043F0B0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0041C160	0_2_0041C160
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0043D970	0_2_0043D970
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_00436970	0_2_00436970
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0042F930	0_2_0042F930
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_004381C0	0_2_004381C0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_004319D0	0_2_004319D0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_004369E0	0_2_004369E0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0044A1B0	0_2_0044A1B0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_00442A40	0_2_00442A40
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0042D320	0_2_0042D320
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_00442200	0_2_00442200
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0042C2F0	0_2_0042C2F0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_00433AF0	0_2_00433AF0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0041AC50	0_2_0041AC50
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0042FC00	0_2_0042FC00
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0043EC30	0_2_0043EC30
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_004744DC	0_2_004744DC
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_004314B0	0_2_004314B0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_00448D40	0_2_00448D40
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0040E5F2	0_2_0040E5F2
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_004245F0	0_2_004245F0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_00438650	0_2_00438650
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0041CE30	0_2_0041CE30
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_00431ED0	0_2_00431ED0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0042D6F0	0_2_0042D6F0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_00441E90	0_2_00441E90
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_00435EB0	0_2_00435EB0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_00424F70	0_2_00424F70
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_004314B0	0_2_004314B0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_004267B0	0_2_004267B0

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: String function: 004499B0 appears 46 times
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: String function: 0041F3F0 appears 252 times

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@94/1050@1/4

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe

File created: C:\Users\CriticalBreachDetected.pdf

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3740:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3868:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1100:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1140:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2768:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1276:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5332:120:WilError_03

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe

File created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\Temp\CriticalBreachDetected.pdf

Jump to behavior

Source: Iir6rxs8r6.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe user32.dll,UpdatePerUserSystemParameters

Source: Iir6rxs8r6.exe

ReversingLabs: Detection: 81%

Source: unknown	Process created: C:\Users\user\Desktop\Iir6rxs8r6.exe "C:\Users\user\Desktop\Iir6rxs8r6.exe"
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1616,i,3413580249765337229,1280072705313980885,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c rundll32.exe user32.dll,UpdatePerUserSystemParameters
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe user32.dll,UpdatePerUserSystemParameters
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\Iir6rxs8r6.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\PING.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /delete /tn Rhsd /f
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c rundll32.exe user32.dll,UpdatePerUserSystemParameters	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\Iir6rxs8r6.exe"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1616,i,3413580249765337229,1280072705313980885,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe user32.dll,UpdatePerUserSystemParameters
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /delete /tn Rhsd /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: Iir6rxs8r6.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: \??\C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\* source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida&O source: Iir6rxs8r6.exe, 00000000.00000002.3233096131.0000000004A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbu source: Iir6rxs8r6.exe, 00000000.00000002.3229153631.0000000003D42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb%m.h source: Iir6rxs8r6.exe, 00000000.00000002.3225224394.0000000003796000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb6 source: Iir6rxs8r6.exe, 00000000.00000002.3225603623.0000000003810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*2tP source: Iir6rxs8r6.exe, 00000000.00000003.1828765583.000000000010A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: emp/Symbols/winload_prod.pdb/01AB9056EA9380F@ source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2wekyb3d8bbwe\LocalCacher Data\Default\Extensions\nmmhkkq source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidar, source: Iir6rxs8r6.exe, 00000000.00000002.3226682985.0000000003934000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb? source: Iir6rxs8r6.exe, 00000000.00000002.3229153631.0000000003D42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbq,+ source: Iir6rxs8r6.exe, 00000000.00000002.3227633984.0000000003B31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaT source: Iir6rxs8r6.exe, 00000000.00000002.3230224009.0000000003EE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: Iir6rxs8r6.exe, 00000000.00000002.3231065025.0000000004044000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229299015.0000000003DCA000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227092348.00000000039E3000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230644769.0000000003F98000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227242449.0000000003A6A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3224379439.00000000036BD000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3235038394.0000000004C5B000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3226196423.000000000388D000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3233775780.0000000004B07000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230224009.0000000003EE6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3234342821.0000000004BA7000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3225224394.0000000003796000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229117500.0000000003D30000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3232582558.00000000041D5000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229557865.0000000003E29000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3226649501.0000000003922000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227994671.0000000003BE2000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3228706934.0000000003C77000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3233254008.0000000004A74000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229153631.0000000003D42000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3225053931.000000000375A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3231485189.0000000004106000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3225182842.0000000003784000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227633984.0000000003B31000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3225603623.0000000003810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: Iir6rxs8r6.exe, 00000000.00000003.1828765583.000000000010A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1829153779.000000000010D000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\CriticalBreachDetected.pdfntdesk\AppDa@ source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: a\Application Data\Temp\Symbols\ntkrnlmp.pdb\CriticalBreachDetected.pdf31cation Dn source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DaC:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\kies\pData\\Apps_{9a386491-5394-47a0-a408-e4e3a9d60139}\e6IT source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2s/fro source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaa source: Iir6rxs8r6.exe, 00000000.00000002.3226196423.000000000388D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: Iir6rxs8r6.exe, 00000000.00000002.3225603623.0000000003810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidaI source: Iir6rxs8r6.exe, 00000000.00000002.3229017243.0000000003D10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidaY source: Iir6rxs8r6.exe, 00000000.00000002.3231485189.0000000004106000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ation Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAS source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ad_prod.pdbe\AC\INetCookies\ESEFta\Appli source: Iir6rxs8r6.exe, 00000000.00000003.1866632282.00000000000FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb6<k source: Iir6rxs8r6.exe, 00000000.00000002.3226649501.0000000003922000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbM, source: Iir6rxs8r6.exe, 00000000.00000002.3227633984.0000000003B31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidalVA source: Iir6rxs8r6.exe, 00000000.00000002.3234928870.0000000004C37000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DaC:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\RX_INSTALL\_locales\zh_CN\alState\tory\ookies\a78ba80c-bc89-4102-a032-406d11845944}\f5r source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/ntkrnlmp.pdb.rhysidadf/Application Data/Application Da source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ation Data\Temp\Symbols\ntkrnlmp.pdb\68A17FA7 source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidag source: Iir6rxs8r6.exe, 00000000.00000002.3228706934.0000000003C77000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysidai,3 source: Iir6rxs8r6.exe, 00000000.00000002.3227633984.0000000003B31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysida source: Iir6rxs8r6.exe, 00000000.00000002.3227092348.00000000039E3000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227203205.0000000003A48000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227595840.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3226366114.00000000038BD000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229709791.0000000003E6F000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3234379156.0000000004BC1000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3234928870.0000000004C37000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3231528985.0000000004118000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3233718568.0000000004AF5000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3228638643.0000000003C4D000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3233096131.0000000004A50000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3232386217.00000000041B3000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230688687.0000000003FAA000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3226682985.0000000003934000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230936905.000000000400D000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3228050105.0000000003BF4000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229017243.0000000003D10000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230257972.0000000003EF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: Iir6rxs8r6.exe, 00000000.00000003.1828765583.000000000010A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb++ source: Iir6rxs8r6.exe, 00000000.00000002.3229557865.0000000003E29000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbs source: Iir6rxs8r6.exe, 00000000.00000002.3226196423.000000000388D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb.rhysidah source: Iir6rxs8r6.exe, 00000000.00000002.3227092348.00000000039E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n Data/Temp/Symbols/winload_prod.pdb/01AB905 source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbB source: Iir6rxs8r6.exe, 00000000.00000002.3230224009.0000000003EE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: Iir6rxs8r6.exe, 00000000.00000002.3231065025.0000000004044000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229299015.0000000003DCA000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227092348.00000000039E3000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230644769.0000000003F98000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227242449.0000000003A6A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3224379439.00000000036BD000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3235038394.0000000004C5B000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3226196423.000000000388D000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3233775780.0000000004B07000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230224009.0000000003EE6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3234342821.0000000004BA7000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3225224394.0000000003796000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229117500.0000000003D30000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3232582558.00000000041D5000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229557865.0000000003E29000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3226649501.0000000003922000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227994671.0000000003BE2000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3228706934.0000000003C77000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3233254008.0000000004A74000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229153631.0000000003D42000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3225053931.000000000375A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3231485189.0000000004106000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3225182842.0000000003784000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227633984.0000000003B31000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3225603623.0000000003810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Symbols\winload_prod.pdb\01AB9056EA9380F7164b source: Iir6rxs8r6.exe, 00000000.00000003.1828765583.000000000010A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2AC2n source: Iir6rxs8r6.exe, 00000000.00000003.1828765583.000000000010A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A58 source: Iir6rxs8r6.exe, 00000000.00000003.1828765583.000000000010A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb} source: Iir6rxs8r6.exe, 00000000.00000002.3230644769.0000000003F98000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbG source: Iir6rxs8r6.exe, 00000000.00000002.3234342821.0000000004BA7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Symbols\winload_prod.pdb\01AB9056EA9380F7164^ source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ols/ntkrnlmp.pdbs32 source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbN source: Iir6rxs8r6.exe, 00000000.00000002.3227092348.00000000039E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ols/ntkrnlmp.pdbhDe source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Symbols\winload_prod.pdb\01AB9056EA9380F7164 source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida[j source: Iir6rxs8r6.exe, 00000000.00000002.3233254008.0000000004A74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831O source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida$ source: Iir6rxs8r6.exe, 00000000.00000002.3232582558.00000000041D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb;] source: Iir6rxs8r6.exe, 00000000.00000002.3231065025.0000000004044000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb3ta source: Iir6rxs8r6.exe, 00000000.00000003.1895165991.0000000000108000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb[ source: Iir6rxs8r6.exe, 00000000.00000002.3234342821.0000000004BA7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb^ source: Iir6rxs8r6.exe, 00000000.00000002.3225182842.0000000003784000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DaC:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\pData\te\er\DOMStore\1/CriticalBreachDetected.pdftrass source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: Iir6rxs8r6.exe, 00000000.00000003.1829035358.00000000000F6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ation Data\Temp\Symbols\ntkrnlmp.pdb\68A17FA source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbd source: Iir6rxs8r6.exe, 00000000.00000002.3225603623.0000000003810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbf source: Iir6rxs8r6.exe, 00000000.00000002.3224379439.00000000036BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida4 source: Iir6rxs8r6.exe, 00000000.00000002.3227092348.00000000039E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb%ss source: Iir6rxs8r6.exe, 00000000.00000002.3225053931.000000000375A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\w source: Iir6rxs8r6.exe, 00000000.00000003.1828765583.000000000010A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\CriticalBreachDetected.pdfocal\Applica source: Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb.rhysida source: Iir6rxs8r6.exe, 00000000.00000002.3231065025.0000000004044000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227092348.00000000039E3000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230644769.0000000003F98000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227242449.0000000003A6A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3235038394.0000000004C5B000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3226196423.000000000388D000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3233775780.0000000004B07000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3230224009.0000000003EE6000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3234342821.0000000004BA7000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229117500.0000000003D30000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3232582558.00000000041D5000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3229557865.0000000003E29000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3226649501.0000000003922000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227994671.0000000003BE2000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3228706934.0000000003C77000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3233254008.0000000004A74000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3231485189.0000000004106000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3227633984.0000000003B31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbl source: Iir6rxs8r6.exe, 00000000.00000002.3225182842.0000000003784000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*a/ source: Iir6rxs8r6.exe, 00000000.00000003.1895165991.0000000000108000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ad_prod.pdb.rhysida source: Iir6rxs8r6.exe, 00000000.00000003.1828765583.000000000010A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.1828732693.00000000000F3000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"

Source: Iir6rxs8r6.exe

Static PE information: section name: .xdata

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\CriticalBreachDetected.pdf			Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\Temp\CriticalBreachDetected.pdf			Jump to behavior

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /delete /tn Rhsd /f

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\7-Zip\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Office Tools\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows PowerShell\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\System Tools\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\AutoItX\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\Default\Start Menu\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\Default\Start Menu\Programs\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\Default\Start Menu\Programs\Accessibility\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\Default\Start Menu\Programs\Accessories\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\Default\Start Menu\Programs\Maintenance\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\Default\Start Menu\Programs\System Tools\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File created: C:\Users\Default\Start Menu\Programs\Windows PowerShell\CriticalBreachDetected.pdf	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\Iir6rxs8r6.exe"
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\Iir6rxs8r6.exe"			Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Window / User API: threadDelayed 5397	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4165
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4814

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe TID: 3640	Thread sleep count: 5397 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe TID: 3640	Thread sleep time: -53970s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2840	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5484	Thread sleep time: -2767011611056431s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe

Code function: 0_2_00419001 GetSystemInfo,malloc,malloc,Sleep,Sleep,free,free,system,system,

0_2_00419001

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File opened: C:\Users\All Users\Application Data\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5}\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File opened: C:\Users\All Users\.curlrc.rhysida	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File opened: C:\Users\All Users\Application Data\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File opened: C:\Users\All Users\Application Data\Adobe\ARM\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File opened: C:\Users\All Users\Application Data\Adobe\CriticalBreachDetected.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	File opened: C:\Users\All Users\Application Data\Adobe\ARM\Acrobat_23.006.20320\CriticalBreachDetected.pdf	Jump to behavior

Source: Iir6rxs8r6.exe, 00000000.00000002.3244141435.000000000577B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-migration-replacement.man
Source: Iir6rxs8r6.exe, 00000000.00000002.3244141435.000000000577B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-client-migration-replacement.man
Source: Iir6rxs8r6.exe, 00000000.00000002.3244141435.000000000577B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-drivers-migration-replacement.man

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-20728

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe

Code function: 0_2_004457D0 IsDebuggerPresent,RaiseException,

0_2_004457D0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_004011B0 Sleep,Sleep,SetUnhandledExceptionFilter,GetStartupInfoA,	0_2_004011B0
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_00447A20 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00447A20
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0047461C SetUnhandledExceptionFilter,	0_2_0047461C
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Code function: 0_2_0044AFE9 SetUnhandledExceptionFilter,	0_2_0044AFE9

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c rundll32.exe user32.dll,UpdatePerUserSystemParameters	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"	Jump to behavior
Source: C:\Users\user\Desktop\Iir6rxs8r6.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\user\Desktop\C:\Users\user\Desktop\Iir6rxs8r6.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe user32.dll,UpdatePerUserSystemParameters
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /delete /tn Rhsd /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\Desktop\Iir6rxs8r6.exe

Code function: 0_2_00447940 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00447940

Source: Iir6rxs8r6.exe, 00000000.00000002.3223883876.0000000003661000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3223405192.00000000034D2000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3223735743.000000000361A000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3223690658.0000000003602000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000003.3182151191.000000000323E000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3222959511.000000000323E000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3223610820.00000000035D8000.00000004.00000020.00020000.00000000.sdmp, Iir6rxs8r6.exe, 00000000.00000002.3223983334.0000000003673000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: MsMpEng.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Blob

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Browser Extensions	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	1 Scheduled Task/Job	1 Scheduled Task/Job	2 Obfuscated Files or Information	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	121 Security Software Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Virtualization/Sandbox Evasion	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		unknown
x1.i.lencr.org	unknown	unknown	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
23.51.56.185	unknown	United States	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
52.5.13.197	unknown	United States	14618	AMAZON-AESUS	false
96.17.64.189	unknown	United States	16625	AKAMAI-ASUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524355
Start date and time:	2024-10-02 17:49:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	66
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Iir6rxs8r6.exe renamed because original name is a hash value
Original Sample Name:	3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe
Detection:	MAL
Classification:	mal100.rans.troj.evad.winEXE@94/1050@1/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 12 Number of non-executed functions: 68
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Time	Type	Description
11:51:31	API Interceptor	20066x Sleep call for process: Iir6rxs8r6.exe modified
11:52:12	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
11:53:23	API Interceptor	15x Sleep call for process: powershell.exe modified
17:51:50	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
23.51.56.185	https://atpscan.global.hornetsecurity.com/?d=r7jv6mGLSFUWnAoVoWKJDiF7kKGt3Fw5kKbn5s5sfcpNyTRbK79Zci2IH8Nl2g5X&f=qvzVe-8YAX4Dy6XefosXpr9xe6cUPxuD05v5wTHFNiMjrMs6M0fDbIikzhduev0q&i=&k=3x5s&m=iAkhIt0HvpR1Oh2_h6Q0O4Hzfyk0g3SV3EvnL7Z4VUDMO-lWq1KA94UsI2rIZoVyTUZY62kGnDiHyWJGH-7ewwHTHsNEmZuBPXaeTQvRVKfNDkV8Z7LfIWxRCCZdooZC&n=ZEhYBDFv208HJKEkNw5PqFObkm08aq7YeFB_fsGRbHtm2gx4mSx3JSwYkGZ1WU18bxwJPkfxXGKYv_KHdz1U8g&r=jfqeskceaKp8lH_i6JGe3T3xyBa6G7cbOCXOc4EPK3XMqLBHJqWBZEP0B9-qih8i&s=7226c2d05f1feec1a62ae2af2728e02cdefac54ea37a3a7665785b4a5864d360&u=https%3A%2F%2Fpitstop.powellind.com%2Fxfer%2Fbhub.cgi%3Fact%3Ddirect_download_file%26package_id%3Dpowelldocmanager%2540powellind%252Ecom%255FO8FN5TMSR40O4R6VOBEQREUV86%26file_name%3Dpowelldocmanager%2540powellind%252Ecom%255FO8FN5TMSR40O4R6VOBEQREUV86%252Ezip%26username%3Ddlarue%2540schmidt%252Delectric%252Ecom%26direct_token%3DB175D31C2AE80D9A572ED101DA29F438%26file_type%3Dzip	Get hash	malicious	Unknown	Browse
	https://dl.dropboxusercontent.com/scl/fi/4mhppt9446w16rxyp8wch/ATDKM0-019002993PDF.zip?rlkey=bolgaypwmfsk0ve6n3zskuk1w&st=655ymbiy&dl=0	Get hash	malicious	Unknown	Browse
	AdobeGenP.exe	Get hash	malicious	Unknown	Browse
	Orden#46789_2024_Optoflux_mexico_sderlss.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	Remittance_ITWWX 5824.pdf	Get hash	malicious	HTMLPhisher	Browse
	41#U044c.exe	Get hash	malicious	Unknown	Browse
	https://api-internal.weblinkconnect.com/api/Communication/Communication/1148248/click?url=https://devbook.net/antibot205&x-tenant=WinterHavenFLCOC	Get hash	malicious	HTMLPhisher	Browse
	PIO88938MB.docx.doc	Get hash	malicious	Unknown	Browse
	http://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:3a03de0d-9ad9-478c-a00b-f8cf4aad7ad9	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:5fd2b75e-76e0-49e5-b618-3adf1ca6f2ff	Get hash	malicious	HTMLPhisher	Browse
52.5.13.197	Contract_Agreement_Wednesday September 2024.pdf	Get hash	malicious	Unknown	Browse
	tftpd32.464.zip	Get hash	malicious	Unknown	Browse
	cho6043ijz.000	Get hash	malicious	Unknown	Browse
	johnny.guanCopy.pdf	Get hash	malicious	Unknown	Browse
	i45qm2Cawa	Get hash	malicious	Unknown	Browse
	pdf.bat	Get hash	malicious	Unknown	Browse
	Jenny Baker-ln service Agreetment-##num##.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:626535c6-68da-4729-b016-6e974989fb70	Get hash	malicious	LummaC Stealer	Browse
	https://eu-files.jotform.com/jufs/Balciunas/form_files/mayeri.66cdabd2a5f975.43943309.pdf?md5=MSrOXntTEwGBrCuETzXGIw&expires=1724764002	Get hash	malicious	Unknown	Browse
	signature.pdf	Get hash	malicious	Unknown	Browse
96.17.64.189	eEu5xPVQUo.exe	Get hash	malicious	Rhysida	Browse
	62-3590.pdf	Get hash	malicious	Unknown	Browse
	eEu5xPVQUo.exe	Get hash	malicious	Rhysida	Browse
	https://files.constantcontact.com/2d77228b901/702368a5-3f96-4cb6-b61d-aab8728be1ff.pdf	Get hash	malicious	Unknown	Browse
	SCAN_Client_No_XP9739270128398468932393.pdf	Get hash	malicious	HTMLPhisher	Browse
	HPDeskJet_043_SCAN.pdf	Get hash	malicious	Phisher	Browse
	Cbequipment-Voice Audio Interface.pdf	Get hash	malicious	HTMLPhisher	Browse
	E-294-SI+6056_20240904_EM_ANA+ESTEVES_3RD+QUARTER+CONTRACT+TERMS+AND+CONDITION+_+SI_C_DITIC_C.pdf	Get hash	malicious	Unknown	Browse
	i45qm2Cawa	Get hash	malicious	Unknown	Browse
	https://connect.intuit.com/portal/app/CommerceNetwork/view/scs-v1-f625d0b32548440b99916848ded025c855d4f60b1cb74ebabee20f0e6b929ffde5bb5649b6334735bc6416c99d558b11?locale=EN_US	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	27987136e29b3032ad40982c8b7c2e168112c9601e08da806119dcba615524b5.html	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://freemangas.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	62-3590.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	lK1DKi27B4.dll	Get hash	malicious	Unknown	Browse	199.232.214.172
	ZAMOWIEN.EXE.exe	Get hash	malicious	GuLoader	Browse	199.232.210.172
	7ffbfc130000.conhost2.dll.dll	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://sportmansguilde.com/?https://www.office.com	Get hash	malicious	Unknown	Browse	199.232.210.172
	Axactor Microsoft - Introduksjonsm#U00f8te.msg	Get hash	malicious	EvilProxy	Browse	199.232.214.172
	http://Asm.alcateia.org	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://cnrsys.com/.jhg/#annQ3bttQ3bd0T2vTau5kZR3wh07xdaiiR3whi-5kZankyH05d0TQ3bu	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	novo.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	198.136.165.108
	novo.x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	44.199.29.4
	yakov.x86.elf	Get hash	malicious	Mirai	Browse	54.27.151.237
	http://www.freemangas.com	Get hash	malicious	Unknown	Browse	34.225.196.48
	https://app.glorify.com/file/1193241?format=90	Get hash	malicious	Unknown	Browse	54.81.238.62
	DV2mrnfX2d.exe	Get hash	malicious	Rhysida	Browse	54.144.73.197
	eEu5xPVQUo.exe	Get hash	malicious	Rhysida	Browse	52.202.204.11
	https://tecvia.ladesk.com/412763-SICHERE-GESCH%C3%84FTSDOKUMENTE	Get hash	malicious	HTMLPhisher	Browse	18.234.10.85
	http://www.johnhdaniel.com	Get hash	malicious	Unknown	Browse	34.237.109.146
	https://convertwithwave.com	Get hash	malicious	Unknown	Browse	3.211.76.154
TMNET-AS-APTMNetInternetServiceProviderMY	yakov.ppc.elf	Get hash	malicious	Mirai	Browse	219.93.199.15
	https://atpscan.global.hornetsecurity.com/?d=r7jv6mGLSFUWnAoVoWKJDiF7kKGt3Fw5kKbn5s5sfcpNyTRbK79Zci2IH8Nl2g5X&f=qvzVe-8YAX4Dy6XefosXpr9xe6cUPxuD05v5wTHFNiMjrMs6M0fDbIikzhduev0q&i=&k=3x5s&m=iAkhIt0HvpR1Oh2_h6Q0O4Hzfyk0g3SV3EvnL7Z4VUDMO-lWq1KA94UsI2rIZoVyTUZY62kGnDiHyWJGH-7ewwHTHsNEmZuBPXaeTQvRVKfNDkV8Z7LfIWxRCCZdooZC&n=ZEhYBDFv208HJKEkNw5PqFObkm08aq7YeFB_fsGRbHtm2gx4mSx3JSwYkGZ1WU18bxwJPkfxXGKYv_KHdz1U8g&r=jfqeskceaKp8lH_i6JGe3T3xyBa6G7cbOCXOc4EPK3XMqLBHJqWBZEP0B9-qih8i&s=7226c2d05f1feec1a62ae2af2728e02cdefac54ea37a3a7665785b4a5864d360&u=https%3A%2F%2Fpitstop.powellind.com%2Fxfer%2Fbhub.cgi%3Fact%3Ddirect_download_file%26package_id%3Dpowelldocmanager%2540powellind%252Ecom%255FO8FN5TMSR40O4R6VOBEQREUV86%26file_name%3Dpowelldocmanager%2540powellind%252Ecom%255FO8FN5TMSR40O4R6VOBEQREUV86%252Ezip%26username%3Ddlarue%2540schmidt%252Delectric%252Ecom%26direct_token%3DB175D31C2AE80D9A572ED101DA29F438%26file_type%3Dzip	Get hash	malicious	Unknown	Browse	23.51.56.185
	rsJtZBgpwG.elf	Get hash	malicious	Mirai	Browse	210.195.145.38
	SecuriteInfo.com.Linux.Siggen.9999.29695.14613.elf	Get hash	malicious	Unknown	Browse	1.9.41.192
	EX778415591042.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	23.51.58.94
	ZgBCG135hk.elf	Get hash	malicious	Mirai, Moobot	Browse	115.134.232.142
	yMg23n1D5d.elf	Get hash	malicious	Mirai, Moobot	Browse	115.135.110.21
	XPK8NKw7Jv.elf	Get hash	malicious	Mirai, Moobot	Browse	60.51.109.236
	ACUN4Da4d7.exe	Get hash	malicious	Unknown	Browse	175.139.130.187
	bexq6dM6iT.exe	Get hash	malicious	Unknown	Browse	175.139.130.187
AKAMAI-ASUS	Setup.exe	Get hash	malicious	LummaC, MicroClip	Browse	104.102.49.254
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	http://view.flodesk.com/emails/66fd2053af85c99dd55d1461	Get hash	malicious	Unknown	Browse	2.19.126.198
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	test.exe	Get hash	malicious	Babadeda	Browse	23.223.209.207
	kuly.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	webNY0O9Sr.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	klFMCT64RF.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	EKAHephXb2.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	webNY0O9Sr.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

Process:	C:\Users\user\Desktop\Iir6rxs8r6.exe
File Type:	PDF document, version 1.5
Category:	dropped
Size (bytes):	36444
Entropy (8bit):	7.991079286274761
Encrypted:	true
SSDEEP:	768:op27y3jaDPTVJor28BrdFSm95XCKTwnIbT1DtBcMWrwTWOrpa:o27y3mNU2QrdMOLTmY5BctREY
MD5:	38C9C6953F1FCB83B1E6E04825F3B4DB
SHA1:	5AF8CAF42B0AB98349C5806F5B22D4402A343DE7
SHA-256:	DFD0BD7B4E4F84287AB4B19BB77D5308EB29E12E8724F04CB8C2FC6D4FB66D62
SHA-512:	6BA08B5FF206A5BB53C60E62DAC872E6473AA419FFED5C09C1CDBB18F1DDE7B2EC268DF8ABC3080FE484A4F0A32D8FEC922F65E959F0DBD91FB8A4272E492ED1
Malicious:	true
Preview:	%PDF-1.5.%.....5 0 obj.<<./Length 1642 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI...7.$M;.z..d..`........._.],@[.}.b.....W.W?.c.M.U..v.s..U...:e.\m..?.oF9.a}.9O....5...E.F:....._2V..q...N..Z....N.....fe...W..2..3z.....:=..o...O..t.fy.g.U....U......7{e.4......;;=.R...4...#Q...4..i..f........k.H.........u.:<3O[m.<..A_.D]....KR.7....d/,..QV.&.......!.^.....=Z'..n..%j..C...p.........%("i.gJ.m..U.y...".......X..[.vz...g.p.(..Q........d!T@..6..\M...3.4..A.l......&..t.6...B.:. KL....i@uz.z".......H...0W..W.....e.........=`.i.\|.C8j..EK.h....Zg..LpB.).N.......T#.;..t....X..........15..=].&X..J.92.\.O..)........#...5..j./&..tO.4..LOJ....^/..wk...tc.".....I\|C.D.+.....QIp./O.K.^.2.Y..'........b..I...t.EO....I.7K..yAx......3]..0..t/-.....a...#-.Z.s..KF..9......JYc.f...U..(.....<.2-..\@.U7...G..QGVgf......Q........R.@.DU.<..O.."GE.)..R....6.k.4M{._.......%&.cR2..)..6.f7.].l.;.\|..K..M.6Up..{7c...........37}..\|0.*..G..~..W.

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.642982407943603
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	Iir6rxs8r6.exe
File size:	431'104 bytes
MD5:	2b825ea77e240d2ab6b6695a602cb07c
SHA1:	ae6eb3cce06f666934e03dd46269526e56aff3b1
SHA256:	3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f
SHA512:	f2029aec439f4727e96436390027e100df521cd6557797a17d50f82335487b2a91ddc04dbd18fb8df96b3deea776ecf429321a55401b7739b1b4979b58db7e39
SSDEEP:	6144:/u+2b7RNhPmrpQRF/2lfhOJoe7NzgMFgTkoQj6RgLaDMT:nGyRe7STng6KaD
TLSH:	37947D2BE7E354BDC16B8074878766736571BC480230E96B13D4DAB0AF619A07BEF325
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......d........../...........................@......................................U....`... ............................

Entrypoint:	0x4014d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6480FE7F [Wed Jun 7 22:02:39 2023 UTC]
TLS Callbacks:	0x447b50
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	515a3064a47ad1391d1e2cc2ed69a98b

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x74000	0x1358	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x65000	0x22c8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x77020	0x28	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x744bc	0x458	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4a178	0x4a200	0f847b469bae1a8111d41e7328879772	False	0.47100613933389546	data	6.372906907102319	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4c000	0x9fa0	0xa000	663c70919801729c5d1fdede54822687	False	0.968603515625	dBase III DBT, version number 0, next free block index 10, 1st item "\256}"	7.943907065783475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x56000	0xedf0	0xee00	3d2648b91eb0ba4a8e80bd6032d1f4ee	False	0.2929359243697479	data	5.766977634733713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x65000	0x22c8	0x2400	35a055806ca6cadb94d8e388269d886b	False	0.4734157986111111	data	5.537955282634158	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x68000	0x222c	0x2400	bcb0bbcba0e7fdd8580d8d1a0a95b83f	False	0.18033854166666666	data	4.27614884951122	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x6b000	0x8420	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x74000	0x1358	0x1400	106191297ead541e2abe4db56ad3ae88	False	0.3154296875	data	4.435914165394017	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x76000	0x70	0x200	10a4ab013baa4fd51143daa7789fc0e9	False	0.080078125	data	0.3146759103346658	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x77000	0x68	0x200	020c0d61c088b0dba939d4d21276ea63	False	0.0625	data	0.2069200177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

DLL	Import
ADVAPI32.dll	CryptAcquireContextA, CryptGenRandom
KERNEL32.dll	AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateSemaphoreA, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetFileAttributesA, GetHandleInformation, GetLastError, GetModuleFileNameW, GetProcessAffinityMask, GetStartupInfoA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDebuggerPresent, LeaveCriticalSection, OutputDebugStringA, QueryPerformanceCounter, RaiseException, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, RtlAddFunctionTable, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetEvent, SetLastError, SetProcessAffinityMask, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, Sleep, SuspendThread, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, UnhandledExceptionFilter, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject
msvcrt.dll	__C_specific_handler, __dllonexit, __doserrno, __getmainargs, __initenv, __iob_func, __lconv_init, __pioinfo, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthreadex, _cexit, _endthreadex, _errno, _exit, _filelengthi64, _fileno, _findclose, _findfirst64, _fmode, _fullpath, _initterm, _lock, _lseeki64, _onexit, _setjmp, _stat64, _ultoa, _unlock, _write, abort, acos, calloc, exit, fclose, fflush, fgetpos, fopen, fprintf, fread, free, frexp, fseek, fsetpos, ftell, fwprintf, fwrite, malloc, memcmp, memcpy, memmove, memset, printf, raise, rand, realloc, rename, signal, sprintf, srand, strcat, strcmp, strcpy, strlen, strncmp, strncpy, system, vfprintf, wcscpy, _time64, _snwprintf, _findnext64, longjmp, _strdup, _getcwd, _chdir
USER32.dll	MessageBoxW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 17:52:12.060750961 CEST	49714	443	192.168.2.7	23.51.56.185
Oct 2, 2024 17:52:12.060844898 CEST	443	49714	23.51.56.185	192.168.2.7
Oct 2, 2024 17:52:12.060978889 CEST	49714	443	192.168.2.7	23.51.56.185
Oct 2, 2024 17:52:12.061125994 CEST	49714	443	192.168.2.7	23.51.56.185
Oct 2, 2024 17:52:12.061156034 CEST	443	49714	23.51.56.185	192.168.2.7
Oct 2, 2024 17:52:12.617130041 CEST	443	49714	23.51.56.185	192.168.2.7
Oct 2, 2024 17:52:12.621687889 CEST	49714	443	192.168.2.7	23.51.56.185
Oct 2, 2024 17:52:12.621752024 CEST	443	49714	23.51.56.185	192.168.2.7
Oct 2, 2024 17:52:12.622657061 CEST	443	49714	23.51.56.185	192.168.2.7
Oct 2, 2024 17:52:12.622756958 CEST	49714	443	192.168.2.7	23.51.56.185
Oct 2, 2024 17:52:12.625699997 CEST	49714	443	192.168.2.7	23.51.56.185
Oct 2, 2024 17:52:12.625762939 CEST	443	49714	23.51.56.185	192.168.2.7
Oct 2, 2024 17:52:12.625979900 CEST	49714	443	192.168.2.7	23.51.56.185
Oct 2, 2024 17:52:12.625999928 CEST	443	49714	23.51.56.185	192.168.2.7
Oct 2, 2024 17:52:12.726114035 CEST	443	49714	23.51.56.185	192.168.2.7
Oct 2, 2024 17:52:12.726227999 CEST	49714	443	192.168.2.7	23.51.56.185
Oct 2, 2024 17:52:12.821145058 CEST	49714	443	192.168.2.7	23.51.56.185
Oct 2, 2024 17:52:12.821216106 CEST	443	49714	23.51.56.185	192.168.2.7
Oct 2, 2024 17:52:14.495347023 CEST	49719	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:14.495455027 CEST	443	49719	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:14.495543957 CEST	49719	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:14.496536970 CEST	49719	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:14.496567965 CEST	443	49719	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:14.814971924 CEST	49720	443	192.168.2.7	96.17.64.189
Oct 2, 2024 17:52:14.815025091 CEST	443	49720	96.17.64.189	192.168.2.7
Oct 2, 2024 17:52:14.815085888 CEST	49720	443	192.168.2.7	96.17.64.189
Oct 2, 2024 17:52:14.815392971 CEST	49720	443	192.168.2.7	96.17.64.189
Oct 2, 2024 17:52:14.815407038 CEST	443	49720	96.17.64.189	192.168.2.7
Oct 2, 2024 17:52:15.066373110 CEST	443	49719	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.066780090 CEST	49719	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.066848040 CEST	443	49719	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.067899942 CEST	443	49719	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.067971945 CEST	49719	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.067998886 CEST	443	49719	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.068063021 CEST	49719	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.112356901 CEST	49719	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.112437963 CEST	443	49719	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.112673998 CEST	49719	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.112718105 CEST	443	49719	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.172310114 CEST	49719	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.248867035 CEST	443	49719	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.248931885 CEST	443	49719	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.249066114 CEST	49719	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.251656055 CEST	49719	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.251657009 CEST	49719	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.251705885 CEST	443	49719	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.251828909 CEST	49719	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.254013062 CEST	49721	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.254055977 CEST	443	49721	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.254113913 CEST	49721	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.254304886 CEST	49721	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.254321098 CEST	443	49721	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.582103014 CEST	443	49720	96.17.64.189	192.168.2.7
Oct 2, 2024 17:52:15.592500925 CEST	49720	443	192.168.2.7	96.17.64.189
Oct 2, 2024 17:52:15.592521906 CEST	443	49720	96.17.64.189	192.168.2.7
Oct 2, 2024 17:52:15.596108913 CEST	443	49720	96.17.64.189	192.168.2.7
Oct 2, 2024 17:52:15.596182108 CEST	49720	443	192.168.2.7	96.17.64.189
Oct 2, 2024 17:52:15.606673956 CEST	49720	443	192.168.2.7	96.17.64.189
Oct 2, 2024 17:52:15.606858015 CEST	443	49720	96.17.64.189	192.168.2.7
Oct 2, 2024 17:52:15.606987000 CEST	49720	443	192.168.2.7	96.17.64.189
Oct 2, 2024 17:52:15.606998920 CEST	443	49720	96.17.64.189	192.168.2.7
Oct 2, 2024 17:52:15.706300974 CEST	443	49720	96.17.64.189	192.168.2.7
Oct 2, 2024 17:52:15.706429005 CEST	49720	443	192.168.2.7	96.17.64.189
Oct 2, 2024 17:52:15.715553045 CEST	49720	443	192.168.2.7	96.17.64.189
Oct 2, 2024 17:52:15.715576887 CEST	443	49720	96.17.64.189	192.168.2.7
Oct 2, 2024 17:52:15.805749893 CEST	443	49721	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.807399035 CEST	49721	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.807425022 CEST	443	49721	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.808301926 CEST	443	49721	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.808363914 CEST	49721	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.808372974 CEST	443	49721	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.808460951 CEST	49721	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.809714079 CEST	49721	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.809770107 CEST	443	49721	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.810405016 CEST	49721	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.810420990 CEST	443	49721	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.875330925 CEST	49721	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.971127987 CEST	443	49721	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.971148014 CEST	443	49721	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.971155882 CEST	443	49721	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.971218109 CEST	443	49721	52.5.13.197	192.168.2.7
Oct 2, 2024 17:52:15.971309900 CEST	49721	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.974844933 CEST	49721	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.993870020 CEST	49721	443	192.168.2.7	52.5.13.197
Oct 2, 2024 17:52:15.993895054 CEST	443	49721	52.5.13.197	192.168.2.7

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 17:50:33.662630081 CEST	1.1.1.1	192.168.2.7	0x735d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:50:33.662630081 CEST	1.1.1.1	192.168.2.7	0x735d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:50:47.208889961 CEST	1.1.1.1	192.168.2.7	0x4453	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:50:47.208889961 CEST	1.1.1.1	192.168.2.7	0x4453	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:52:12.576070070 CEST	1.1.1.1	192.168.2.7	0x2a3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:52:41.881325006 CEST	1.1.1.1	192.168.2.7	0xeb76	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:52:41.881325006 CEST	1.1.1.1	192.168.2.7	0xeb76	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:52:12 UTC	378	OUT	GET / HTTP/1.1 Host: geo2.adobe.com Connection: keep-alive Accept: application/json Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br
2024-10-02 15:52:12 UTC	219	IN	HTTP/1.1 200 OK Content-Length: 50 Date: Wed, 02 Oct 2024 15:52:12 GMT Connection: close Content-Type: application/json Throughput: vhigh Network-Type: Country: US Cross-Origin-Resource-Policy: cross-origin
2024-10-02 15:52:12 UTC	50	IN	Data Raw: 43 6f 75 6e 74 72 79 3a 20 22 55 53 22 20 73 74 61 74 65 3a 20 22 4e 4a 22 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 3a 20 22 65 6e 2d 55 53 22 Data Ascii: Country: "US" state: "NJ" Accept-Language: "en-US"

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:52:15 UTC	1353	OUT	OPTIONS /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1 Host: p13n.adobe.io Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-adobe-uuid,x-adobe-uuid-type,x-api-key Origin: https://rna-resource.acrobat.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://rna-resource.acrobat.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 15:52:15 UTC	572	IN	HTTP/1.1 204 No Content Server: openresty Date: Wed, 02 Oct 2024 15:52:15 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Headers: Authorization,Content-Type,X-Api-Key,cache-control,User-Agent,If-None-Match,x-adobe-uuid,x-adobe-uuid-type, X-Request-Id Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: x-request-id X-Request-Id: y202at8MhFGZ7HDIyhSczN1NSyTo2Sdk Strict-Transport-Security: max-age=15552000; includeSubDomains

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Iir6rxs8r6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\CriticalBreachDetected.pdf

C:\$WinREAgent\Scratch\CriticalBreachDetected.pdf

C:\CriticalBreachDetected.pdf

C:\ProgramData\.curlrc.rhysida

C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320\CriticalBreachDetected.pdf

C:\ProgramData\Adobe\ARM\CriticalBreachDetected.pdf

C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5}\CriticalBreachDetected.pdf

C:\ProgramData\Adobe\CriticalBreachDetected.pdf

C:\ProgramData\CriticalBreachDetected.pdf

C:\ProgramData\Microsoft OneDrive\CriticalBreachDetected.pdf

C:\ProgramData\Microsoft OneDrive\setup\CriticalBreachDetected.pdf

Windows Analysis Report
Iir6rxs8r6.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:52:15 UTC	390	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br
2024-10-02 15:52:15 UTC	247	IN	HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Accept-Ranges: bytes Content-Length: 120 Content-Type: text/plain; charset=UTF-8 Date: Wed, 02 Oct 2024 15:52:15 GMT Connection: close
2024-10-02 15:52:15 UTC	120	IN	Data Raw: 46 69 6c 65 20 74 68 61 74 20 61 63 74 73 20 6c 69 6b 65 20 61 20 4b 69 6c 6c 20 73 77 69 74 63 68 20 66 6f 72 20 53 4d 53 20 66 75 6e 63 74 69 6f 6e 61 6c 69 74 79 20 69 6e 20 52 65 61 64 65 72 2e 20 44 65 6c 65 74 65 20 74 68 69 73 20 66 69 6c 65 20 74 6f 20 65 6e 61 62 6c 65 20 74 68 65 20 6b 69 6c 6c 20 73 77 69 74 63 68 20 69 6e 20 52 65 61 64 65 72 2e Data Ascii: File that acts like a Kill switch for SMS functionality in Reader. Delete this file to enable the kill switch in Reader.

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:52:15 UTC	1473	OUT	GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1 Host: p13n.adobe.io Connection: keep-alive sec-ch-ua: "Chromium";v="105" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 x-adobe-uuid: c583ad55-e27a-405e-ae1a-c48b4361aa9d x-adobe-uuid-type: visitorId x-api-key: AdobeReader9 sec-ch-ua-platform: "Windows" Origin: https://rna-resource.acrobat.com Accept-Language: en-US,en;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://rna-resource.acrobat.com/ Accept-Encoding: gzip, deflate, br
2024-10-02 15:52:15 UTC	608	IN	HTTP/1.1 200 Server: openresty Date: Wed, 02 Oct 2024 15:52:15 GMT Content-Type: application/json;charset=UTF-8 Content-Length: 6301 Connection: close x-request-id: ljeOua0litJDX9TxpyUNOfIcvjGdNA2D vary: accept-encoding Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Headers: Authorization,Content-Type,X-Api-Key,cache-control,User-Agent,If-None-Match,x-adobe-uuid,x-adobe-uuid-type, X-Request-Id Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: x-request-id Strict-Transport-Security: max-age=15552000; includeSubDomains
2024-10-02 15:52:15 UTC	6301	IN	Data Raw: 7b 22 73 75 72 66 61 63 65 73 22 3a 7b 22 44 43 5f 52 65 61 64 65 72 5f 52 48 50 5f 42 61 6e 6e 65 72 22 3a 7b 22 63 6f 6e 74 61 69 6e 65 72 73 22 3a 5b 7b 22 63 6f 6e 74 61 69 6e 65 72 49 64 22 3a 31 2c 22 63 6f 6e 74 61 69 6e 65 72 4c 61 62 65 6c 22 3a 22 4a 53 4f 4e 20 66 6f 72 20 52 65 61 64 65 72 20 44 43 20 52 48 50 20 42 61 6e 6e 65 72 22 2c 22 64 61 74 61 54 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 2c 22 64 61 74 61 22 3a 22 65 79 4a 6a 64 47 45 69 4f 6e 73 69 64 48 6c 77 5a 53 49 36 49 6d 4a 31 64 48 52 76 62 69 49 73 49 6e 52 6c 65 48 51 69 4f 69 4a 47 63 6d 56 6c 49 44 63 74 52 47 46 35 49 46 52 79 61 57 46 73 49 69 77 69 5a 32 39 66 64 58 4a 73 49 6a 6f 69 61 48 52 30 63 48 4d 36 4c 79 39 68 59 33 4a 76 59 6d 46 30 Data Ascii: {"surfaces":{"DC_Reader_RHP_Banner":{"containers":[{"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","dataType":"application/json","data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0

Target ID:	0
Start time:	11:50:14
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\Iir6rxs8r6.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Iir6rxs8r6.exe"
Imagebase:	0x400000
File size:	431'104 bytes
MD5 hash:	2B825EA77E240D2AB6B6695A602CB07C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	11:51:58
Start date:	02/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CriticalBreachDetected.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	11:52:00
Start date:	02/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	14
Start time:	11:52:01
Start date:	02/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1616,i,3413580249765337229,1280072705313980885,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	20
Start time:	11:53:18
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f
Imagebase:	0x7ff68b620000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	30
Start time:	11:53:19
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
Imagebase:	0x7ff68b620000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	40
Start time:	11:53:20
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
Imagebase:	0x7ff68b620000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	54
Start time:	11:53:21
Start date:	02/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe user32.dll,UpdatePerUserSystemParameters
Imagebase:	0x7ff69e220000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true