Virus (Day)

Number of Endpoint TShreat Severity
3613 Critical
63 Alert
3676 Total
System Name Threat Source IP adThreat Name Group Na
LL-GD-TRINHLTH 10.64.67.140 HackTool-Shadowbrokers Ho Chi Mi
LL-GD-TRINHLTH 10.64.67.140 RDN/Generic Exploit Ho Chi Mi
LL-GD-TRINHLTH 10.64.67.140 Generic.abu Ho Chi Mi
LL-GD-TRINHLTH 10.64.67.140 Generic.adk Ho Chi Mi
LL-GD-TRINHLTH 10.64.67.140 Generic.aya Ho Chi Mi
LL-GD-TRINHLTH 10.64.67.140 RDN/Generic.dx Ho Chi Mi
LL-GD-TRINHLTH 10.64.67.140 RDN/Generic.dx Ho Chi Mi
LL-GD-TRINHLTH 10.64.67.140 Trojan-EternalBlue Ho Chi Mi
LL-GD-TRINHLTH 10.64.67.140 Generic.adc Ho Chi Mi
LL-GD-TRINHLTH 10.64.67.140 GenericRXDB-PR!770D0CAA24D9 Ho Chi Mi
LL-GD-TRINHLTH 10.64.67.140 Generic.adk Ho Chi Mi
LL-KS-MAINTN 10.64.67.80 HackTool-Shadowbrokers Ho Chi Mi
LL-KSNB-HOANNN 10.64.67.88 HackTool-Shadowbrokers Ho Chi Mi
LL-KSNB-HOANNN 10.64.67.88 Trojan-EternalBlue Ho Chi Mi
LL-KSNB-HOANNN 10.64.67.88 Trojan-EternalBlue Ho Chi Mi
LL-KSNB-HOANNN 10.64.67.88 Generic.adk Ho Chi Mi
LL-KSNB-HOANNN 10.64.67.88 Generic.aya Ho Chi Mi
LL-KSNB-HOANNN 10.64.67.88 Generic.abu Ho Chi Mi
LL-KSNB-HOANNN 10.64.67.88 GenericRXDB-PR!770D0CAA24D9 Ho Chi Mi
LL-KSNB-HOANNN 10.64.67.88 RDN/Generic.dx Ho Chi Mi
LL-KSNB-HOANNN 10.64.67.88 Generic.adk Ho Chi Mi
LL-KSNB-HOANNN 10.64.67.88 RDN/Generic Exploit Ho Chi Mi
LL-KSNB-HOANNN 10.64.67.88 Generic.adc Ho Chi Mi
LL-KT-NGANTT 10.64.67.244 Trojan-EternalBlue Ho Chi Mi
LL-KT-NGANTT 10.64.67.244 Generic.abu Ho Chi Mi
LL-KT-NGANTT 10.64.67.244 Generic.adc Ho Chi Mi
LL-KT-NGANTT 10.64.67.244 HackTool-Shadowbrokers Ho Chi Mi
LL-KT-NGANTT 10.64.67.244 RDN/Generic.dx Ho Chi Mi
LL-KT-NGANTT 10.64.67.244 RDN/Generic Exploit Ho Chi Mi
LL-KT-NGANTT 10.64.67.244 Generic.adk Ho Chi Mi
LL-KT-NGANTT 10.64.67.244 Generic.aya Ho Chi Mi
LL-KT-NGANTT 10.64.67.244 GenericRXDB-PR!770D0CAA24D9 Ho Chi Mi
LL-KT-NGANTT 10.64.67.244 Generic.adk Ho Chi Mi
LL-KT-PHUONGNT 10.64.67.68 Trojan-EternalBlue Ho Chi Mi
LL-KT-PHUONGNT 10.64.67.68 Generic.abu Ho Chi Mi
LL-KT-PHUONGNT 10.64.67.68 Generic.aya Ho Chi Mi
LL-KT-PHUONGNT 10.64.67.68 Generic.adk Ho Chi Mi
LL-KT-PHUONGNT 10.64.67.68 RDN/Generic.dx Ho Chi Mi
LL-KT-PHUONGNT 10.64.67.68 RDN/Generic Exploit Ho Chi Mi
LL-KT-PHUONGNT 10.64.67.68 Generic.adc Ho Chi Mi
LL-KT-PHUONGNT 10.64.67.68 GenericRXDB-PR!770D0CAA24D9 Ho Chi Mi
LL-KT-PHUONGNT 10.64.67.68 HackTool-Shadowbrokers Ho Chi Mi
LL-PT-DUCTQ 10.64.67.81 Generic.aya Ho Chi Mi
LL-PT-DUCTQ 10.64.67.81 Generic.adc Ho Chi Mi
LL-PT-DUCTQ 10.64.67.81 Generic.abu Ho Chi Mi
LL-PT-DUCTQ 10.64.67.81 RDN/Generic Exploit Ho Chi Mi
LL-PT-DUCTQ 10.64.67.81 Generic.adk Ho Chi Mi
LL-PT-DUCTQ 10.64.67.81 RDN/Generic.dx Ho Chi Mi
LL-PT-DUCTQ 10.64.67.81 GenericRXDB-PR!770D0CAA24D9 Ho Chi Mi
LL-PT-DUCTQ 10.64.67.81 Trojan-EternalBlue Ho Chi Mi
LL-PT-DUCTQ 10.64.67.81 Generic.acq Ho Chi Mi
LL-PT-DUCTQ 10.64.67.81 HackTool-Shadowbrokers Ho Chi Mi
LL-PT-DUCTQ 10.64.67.81 Generic.ayj Ho Chi Mi
LL-TH-GIAUPTN 10.64.67.69 HackTool-Shadowbrokers Ho Chi Mi
LL-TH-GIAUPTN 10.64.67.69 Generic.abu Ho Chi Mi
LL-TH-GIAUPTN 10.64.67.69 Generic.aya Ho Chi Mi
LL-TH-GIAUPTN 10.64.67.69 RDN/Generic.dx Ho Chi Mi
LL-TH-GIAUPTN 10.64.67.69 RDN/Generic Exploit Ho Chi Mi
LL-TH-GIAUPTN 10.64.67.69 Generic.adc Ho Chi Mi
LL-TH-GIAUPTN 10.64.67.69 Generic.adk Ho Chi Mi
LL-TH-GIAUPTN 10.64.67.69 RDN/Generic.dx Ho Chi Mi
LL-TH-GIAUPTN 10.64.67.69 Generic.adk Ho Chi Mi
LL-TH-GIAUPTN 10.64.67.69 GenericRXDB-PR!770D0CAA24D9 Ho Chi Mi
LL-TH-GIAUPTN 10.64.67.69 Trojan-EternalBlue Ho Chi Mi
LL-TH-GIAUPTN 10.64.67.69 Trojan-EternalBlue Ho Chi Mi
LL-TVTC-DUCDT 10.64.67.238 HackTool-Shadowbrokers Ho Chi Mi
LL-TVTC-HANGNT 10.64.67.239 Trojan-EternalBlue Ho Chi Mi
LL-TVTC-HANGNT 10.64.67.239 HackTool-Shadowbrokers Ho Chi Mi
LL-TVTC-HANGNT 10.64.67.239 Generic.adc Ho Chi Mi
LL-TVTC-HANGNT 10.64.67.239 Generic.aya Ho Chi Mi
LL-TVTC-HANGNT 10.64.67.239 Generic.adk Ho Chi Mi
LL-TVTC-HANGNT 10.64.67.239 GenericRXDB-PR!770D0CAA24D9 Ho Chi Mi
LL-TVTC-HANGNT 10.64.67.239 RDN/Generic.dx Ho Chi Mi
LL-TVTC-HANGNT 10.64.67.239 Generic.abu Ho Chi Mi
LL-TVTC-HANGNT 10.64.67.239 RDN/Generic Exploit Ho Chi Mi
LL-TVTC-HANGNT 10.64.67.239 Generic.adk Ho Chi Mi
LL-TVTC-HANGNT 10.64.67.239 RDN/Generic.dx Ho Chi Mi
LL-TVTC-YENDT 10.64.67.142 Generic.abu Ho Chi Mi
LL-TVTC-YENDT 10.64.67.142 RDN/Generic.dx Ho Chi Mi
LL-TVTC-YENDT 10.64.67.142 RDN/Generic Exploit Ho Chi Mi
LL-TVTC-YENDT 10.64.67.142 Generic.aya Ho Chi Mi
LL-TVTC-YENDT 10.64.67.142 Generic.adc Ho Chi Mi
LL-TVTC-YENDT 10.64.67.142 Generic.adk Ho Chi Mi
LL-TVTC-YENDT 10.64.67.142 Trojan-EternalBlue Ho Chi Mi
LL-TVTC-YENDT 10.64.67.142 GenericRXDB-PR!770D0CAA24D9 Ho Chi Mi
LL-TVTC-YENDT 10.64.67.142 Generic.adc Ho Chi Mi
LL-TVTC-YENDT 10.64.67.142 RDN/Generic Exploit Ho Chi Mi
LL-TVTC-YENDT 10.64.67.142 GenericRXDB-PR!770D0CAA24D9 Ho Chi Mi
LL-TVTC-YENDT 10.64.67.142 HackTool-Shadowbrokers Ho Chi Mi
LL-TVTC-YENDT 10.64.67.142 HackTool-Shadowbrokers Ho Chi Mi
LL-DT-THAIHC 10.64.67.44 Adware-Elex Ho Chi Mi
LL-GD-TRINHLTH 10.64.67.140 RDN/Autorun.worm.gen Ho Chi Mi
LL-KS-MAINTN 10.64.67.80 Trojan-Vools Ho Chi Mi
LL-KSNB-HOANNN 10.64.67.88 Trojan-Vools Ho Chi Mi
LL-KT-NGANTT 10.64.67.244 Trojan-Vools Ho Chi Mi
LL-KT-PHUONGNT 10.64.67.68 RDN/Autorun.worm.gen Ho Chi Mi
LL-KT-PHUONGNT 10.64.67.68 RDN/Autorun.worm.gen Ho Chi Mi
LL-PT-DUCTQ 10.64.67.81 RDN/Autorun.worm.gen Ho Chi Mi
LL-PT-DUCTQ 10.64.67.81 RDN/Autorun.worm.gen Ho Chi Mi
LL-TH-GIAUPTN 10.64.67.69 Trojan-Vools Ho Chi Mi
LL-TVTC-DUCDT 10.64.67.238 RDN/Autorun.worm.gen Ho Chi Mi
LL-TVTC-DUCDT 10.64.67.238 RDN/Autorun.worm.gen Ho Chi Mi
LL-TVTC-HANGNT 10.64.67.239 RDN/Autorun.worm.gen Ho Chi Mi
LL-TVTC-HANGNT 10.64.67.239 RDN/Autorun.worm.gen Ho Chi Mi
LL-TVTC-YENDT 10.64.67.142 RDN/Autorun.worm.gen Ho Chi Mi
LL-TVTC-YENDT 10.64.67.142 RDN/Autorun.worm.gen Ho Chi Mi
Event Generated Time Threat Target File Path Threat SeveAction Taken
1/10/19 12:31:45 PM ICT C:\Windows\AppDiagnostics\svchost.exe Critical Delete
1/10/19 10:31:32 AM ICT C:\Windows\AppDiagnostics\svchost.exe Critical Delete
1/10/19 2:33:44 PM ICT C:\Windows\AppDiagnostics\eteb-2.dll Critical Delete
1/10/19 2:33:46 PM ICT C:\Windows\AppDiagnostics\etch-0.dll Critical Delete
1/10/19 2:33:47 PM ICT C:\Windows\AppDiagnostics\etebCore-2.x64.dll Critical Delete
1/10/19 2:33:47 PM ICT C:\Windows\AppDiagnostics\crli-0.dll Critical Delete
1/10/19 2:33:50 PM ICT C:\Windows\AppDiagnostics\dmgd-4.dll Critical Delete
1/10/19 2:34:03 PM ICT C:\Windows\AppDiagnostics\etchCore-0.x86.dll Critical Delete
1/10/19 2:34:03 PM ICT C:\Windows\AppDiagnostics\cnli-1.dll Critical Delete
1/10/19 2:34:20 PM ICT C:\Windows\AppDiagnostics\esco-0.dll Critical Delete
1/10/19 2:32:11 PM ICT C:\Windows\AppDiagnostics\Eternalblue-2.2.0.f Critical Delete
1/10/19 2:34:21 PM ICT C:\Windows\AppDiagnostics\coli-0.dll Critical Delete
1/10/19 2:34:21 PM ICT C:\Windows\AppDiagnostics\adfw.dll Critical Delete
1/10/19 2:34:23 PM ICT C:\Windows\AppDiagnostics\adfw-2.dll Critical Delete
1/10/19 12:25:03 PM ICT C:\WINDOWS\APPDIAGNOSTICS\SVCHOST.EXE Critical Delete
1/10/19 10:24:54 AM ICT C:\Windows\AppDiagnostics\Eternalblue-2.2.0.f Critical Delete
1/10/19 10:24:59 AM ICT C:\Windows\AppDiagnostics\Eternalchampion-2.0.0.f Critical Delete
1/10/19 10:26:15 AM ICT C:\Windows\AppDiagnostics\crli-0.dll Critical Delete
1/10/19 10:26:24 AM ICT C:\Windows\AppDiagnostics\cnli-1.dll Critical Delete
1/10/19 10:26:24 AM ICT C:\Windows\AppDiagnostics\svchost.exe Critical Delete pending
1/10/19 10:26:28 AM ICT C:\Windows\AppDiagnostics\etebCore-2.x64.dll Critical Delete
1/10/19 10:26:33 AM ICT C:\Windows\AppDiagnostics\adfw.dll Critical Delete
1/10/19 10:26:34 AM ICT C:\Windows\AppDiagnostics\dmgd-1.dll Critical Delete
1/10/19 10:26:40 AM ICT C:\Windows\AppDiagnostics\etchCore-0.x86.dll Critical Delete
1/10/19 10:27:08 AM ICT C:\Windows\AppDiagnostics\esco-0.dll Critical Delete
1/10/19 10:27:16 AM ICT C:\Windows\AppDiagnostics\etch-0.dll Critical Delete
1/10/19 10:27:16 AM ICT C:\Windows\AppDiagnostics\adfw-2.dll Critical Delete
1/10/19 10:27:27 AM ICT C:\Windows\AppDiagnostics\eteb-2.dll Critical Delete
1/10/19 10:27:35 AM ICT C:\Windows\AppDiagnostics\exma-1.dll Critical Delete pending
1/10/19 10:27:50 AM ICT C:\Windows\AppDiagnostics\coli-0.dll Critical Delete
1/10/19 10:19:04 AM ICT C:\Windows\AppDiagnostics\exma-1.dll Critical Delete
1/10/19 12:35:09 PM ICT C:\Windows\AppDiagnostics\exma-1.dll Critical Delete
1/10/19 12:33:25 PM ICT C:\Windows\AppDiagnostics\Eternalchampion-2.0.0.f Critical Delete
1/10/19 2:50:36 PM ICT C:\Windows\AppDiagnostics\pcreposix-0.dll Critical Delete
1/10/19 2:50:38 PM ICT C:\Windows\AppDiagnostics\posh-0.dll Critical Delete
1/10/19 2:50:39 PM ICT C:\Windows\AppDiagnostics\posh.dll Critical Delete
1/10/19 2:50:40 PM ICT C:\Windows\AppDiagnostics\pytrch.py Critical Delete
1/10/19 2:50:42 PM ICT C:\Windows\AppDiagnostics\pytrch.pyc Critical Delete
1/10/19 2:50:50 PM ICT C:\Windows\AppDiagnostics\riar-2.dll Critical Delete
1/10/19 2:50:51 PM ICT C:\Windows\AppDiagnostics\spoolsv.exe Critical Delete
1/10/19 2:50:51 PM ICT C:\Windows\AppDiagnostics\riar.dll Critical Delete
1/10/19 2:50:51 PM ICT C:\Windows\AppDiagnostics\ssleay32.dll Critical Delete
1/10/19 2:51:31 PM ICT C:\Windows\AppDiagnostics\pcre-0.dll Critical Delete
1/10/19 3:03:51 PM ICT C:\Windows\AppDiagnostics\pcrecpp-0.dll Critical Delete
1/10/19 3:04:58 PM ICT C:\Windows\AppDiagnostics\exma.dll Critical Delete
1/10/19 3:11:14 PM ICT C:\Windows\AppDiagnostics\out.dll Critical Delete
1/10/19 3:11:16 PM ICT C:\Windows\AppDiagnostics\libeay32.dll Critical Delete
1/10/19 3:11:16 PM ICT C:\Windows\AppDiagnostics\libiconv-2.dll Critical Delete
1/10/19 3:11:16 PM ICT C:\Windows\AppDiagnostics\pcla-0.dll Critical Delete
1/10/19 3:11:17 PM ICT C:\Windows\AppDiagnostics\libcurl.dll Critical Delete
1/10/19 3:11:18 PM ICT C:\Windows\AppDiagnostics\libxml2.dll Critical Delete
1/10/19 3:11:18 PM ICT C:\Windows\AppDiagnostics\iconv.dll Critical Delete
1/10/19 1:05:38 PM ICT C:\users\nhathq\appdata\roaming\winsapsvc\winsap.dll Alert Deny access
1/10/19 11:20:39 AM ICT C:\users\nhathq\appdata\roaming\winsapsvc\winsap.dll Alert Deny access
1/10/19 10:07:39 AM ICT C:\users\nhathq\appdata\roaming\winsapsvc\winsap.dll Alert Deny access
1/10/19 8:41:53 AM ICT C:\windows\system32\snmpstorsrv.dll Alert Deny access
1/9/19 8:18:57 PM ICT C:\windows\system32\snmpstorsrv.dll Alert Deny access
Action Taken
Delete pending
Delete pending
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access
Deny access

Virus (Day)

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Virus (Day)

Uploaded by

Copyright:

Available Formats

Number of Endpoint TShreat Severity

You might also like