Analysis
-
max time kernel
79s -
max time network
110s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
17-09-2020 23:56
Static task
static1
Behavioral task
behavioral1
Sample
cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe
Resource
win10v200722
General
-
Target
cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe
-
Size
2.4MB
-
MD5
a239735cddd49236ae3562d43d83a8e4
-
SHA1
35bad8d66c79af9dabdcdd8dcebfc0440efc42a1
-
SHA256
cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c
-
SHA512
34bbfc20d82c4227f9e745f0f7cdb5ce68c684a4a84cde0340fa82601f9340fcb7d21c6060564be8580dcba8c3d1b5a16b28ab6964508e0d1ab994b59a818fef
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\HACKED.txt
smaug
http://smaugrwmaystthfxp72tlmdbrzlwdp2pxtpvtzvhkv5ppg3difiwonad.onion
https://paxful.com/
https://changelly.com/
https://www.bitcoindepot.com/
Signatures
-
Smaug
Ransomware-as-a-service first seen marketed on forums etc. in early 2020.
-
Drops file in Drivers directory 2 IoCs
Processes:
cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exedescription ioc process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\drivers\gmreadme.txt.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 356 IoCs
Processes:
cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exedescription ioc process File opened for modification C:\Windows\SysWOW64\wbem\xsl-mappings.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\ScavengeSpace.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\license.rtf.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnbrcl1.inf_amd64_205cfd311a6b4e83\BRIBMF0C-PIPELINECONFIG.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNBX9NPIPELINECONFIG.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNB_EVENTS.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\Licenses\neutral\_Default\Professional\license.rtf.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\MailContactsCalendarSync\LiveDomainList.txt.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\tcpbidi.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SysWOW64\@EnrollmentToastIcon.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SysWOW64\Licenses\neutral\_Default\Professional\license.rtf.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SysWOW64\WindowsCodecsRaw.txt.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SysWOW64\wsmanconfig_schema.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNBX9WPIPELINECONFIG.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prndlclv.inf_amd64_e2158c7cf3110141\DLclVB.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_6df3b80c4f6b8f8d\MXDW-pipelineconfig.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNBX9ZPIPELINECONFIG.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnfxcl2.inf_amd64_f26eeb7da72ee32b\fxxpscolor-pipelineconfig.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_faa2804656671550\MPDW_devmode_map.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnxxcl4.inf_amd64_51802a081cf64b2b\xrP6PP-pipelineconfig.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\SecurityAndMaintenance_Alert.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\oobe\en-US\OOBE_HELP_Opt_in_Details.rtf.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\@language_notification_icon.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnbrcl1.inf_amd64_205cfd311a6b4e83\BRIBMF08-PIPELINECONFIG.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnepcl2.inf_amd64_5940f4dc3bf9366e\EP0NXM10-PipelineConfig.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsacl1.inf_amd64_8adcb7af71f53089\saCPS-pipelineconfig.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\Licenses\neutral\OEM\Professional\license.rtf.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\rasctrnm.h.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SysWOW64\Speech_OneCore\Common\en-US\tokens_TTS_en-US.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SysWOW64\icsxml\ipcfg.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\@WindowsUpdateToastIcon.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\MSDRM\MsoIrmProtector.xls.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\Printing_Admin_Scripts\en-US\prnmngr.vbs.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\Speech_OneCore\common\tokens.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\oobe\en-US\privacy.rtf.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\Sysprep\ActionFiles\Specialize.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\WdsUnattendTemplate.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SysWOW64\@AudioToastIcon.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacl1.inf_amd64_5cab2573ec016b93\CNN08CL1_bidispm.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacl2.inf_amd64_d0fd8eb0443cec17\CNN08CL2_PipelineConfig.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prngeclv.inf_amd64_5626f47f96e3c55b\GEclVB.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhpcl1.inf_amd64_c6040b9adc0369af\amd64\hpbxwsdbidiextnwb.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_faa2804656671550\MPDW-PDC.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\WindowsCodecsRaw.txt.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnbrcl1.inf_amd64_205cfd311a6b4e83\BRIBMF01-PIPELINECONFIG.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNB_BIDIWSD3.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prndlclf.inf_amd64_efe1d550b7437499\dlclf0-pipelineconfig.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_3aa7e4fc9c545305\Amd64\MSAppMon-pipelineconfig.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnokcl1.inf_amd64_d54b831cc2bc714b\OKESCPU-pipelineconfig.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsacl1.inf_amd64_8adcb7af71f53089\saBXP-pipelineconfig.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\SecurityAndMaintenance_Error.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SysWOW64\Speech_OneCore\Common\en-US\Tokens_SR_en-US-N.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prndlcl1.inf_amd64_dbe82d5f3b18ec9a\deCP6-pipelineconfig.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\MSDRM\MsoIrmProtector.doc.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\applets\IMJPCLST.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SysWOW64\license.rtf.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\@edptoastimage.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNBXATPIPELINECONFIG.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnnecl2.inf_amd64_fdd93c90b4633940\nehb1-PipelineConfig.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnbrcl1.inf_amd64_205cfd311a6b4e83\BRIBMF03-PIPELINECONFIG.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prndlcl1.inf_amd64_dbe82d5f3b18ec9a\deSP-pipelineconfig.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnepcl2.inf_amd64_5940f4dc3bf9366e\EP0NXSA0-PipelineConfig.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnepcl2.inf_amd64_5940f4dc3bf9366e\EP0NXSB0-PipelineConfig.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe -
Drops file in Program Files directory 11144 IoCs
Processes:
cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exedescription ioc process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\Weather_BadgeLogo.scale-100.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Beach\beach_12c.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\7813_48x48x32.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-150.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\191.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\western_background.jpg.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StopwatchWideTile.scale-100.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\1937_36x36x32.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSmallTile.scale-200.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\SkypeAppList.targetsize-16_contrast-white.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-30_altform-unplated.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedSmallTile.scale-100_contrast-black.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Heart.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupWideTile.scale-200.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-30.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\vi_get.svg.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-36_altform-unplated.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7205_24x24x32.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OneConnectAppList.targetsize-32.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ci_60x42.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\LargeTile.scale-200.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\WorldClockMedTile.scale-100.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\WideTile.scale-200.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-24_altform-unplated.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-200.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\8041_32x32x32.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\WideTile.scale-125.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Catalog\shape_cone.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_LogoSmall.targetsize-32.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\pt_60x42.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN097.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-white\WideLogo.scale-200_contrast-white.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2494_32x32x32.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_scale-100.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-48.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\PlaylistMediumTile.scale-100.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c\AppxBlockMap.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-200_contrast-white.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\is_60x42.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\sh_60x42.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\tr_get.svg.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\DailyChallenges\Icons\freecell.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\AppxManifest.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailLargeTile.scale-400.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1851_24x24x32.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-96_contrast-white.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_contrast-black.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-125_contrast-white.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\PrizeHistory\awards_base.jpg.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Beach\mask\1d.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README_en_GB.txt.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-400.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe -
Drops file in Windows directory 13899 IoCs
Processes:
cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exedescription ioc process File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\SmallLogo.scale-200.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\BooleanMerge.scale-140.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\common\Good_To_Be_King_.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.15063.0_none_9f3c46c576c7284f\SplashScreen.Theme-Dark_Scale-180.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..trast-black.cortana_31bf3856ad364e35_10.0.15063.0_none_9ee2bb765647bac9\AppListIcon.targetsize-16.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\WinSxS\amd64_prncacla.inf_31bf3856ad364e35_10.0.15063.0_none_b5e633933a90d26d\Amd64\CNB_BIDIWSD1.XML.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\de_60x42.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\Lumia.ViewerPlugin\Assets\IconOpenInRefocus.scale-100.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Assets\Icons\custom-Miantuan\WideTile.scale-150.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\bz_16x11.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-40_altform-unplated_contrast-high.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteMediumTile.scale-150.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Dark.scale-125.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_10.0.15063.0_en-us_0d9bfbee7ca99c5b\lipeula.rtf.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\hn_60x42.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCache-Dark.scale-100.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Grammar\4009\PPIVoiceAgents.4009.cfg.gz.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SystemApps\ContactSupport_cw5n1h2txyewy\Assets\TinyTile.targetsize-256.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.15063.0_none_5a69877f495f87b2\RatingStars50.contrast-black_scale-200.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_TileLargeSquare.scale-200.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\LinkedInboxSmallTile.scale-200.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.15063.0_none_224b97ad28ee338b\MicrosoftEdgeSquare44x44.targetsize-48.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SystemApps\DesktopView_cw5n1h2txyewy\Assets\Images\Wide310x150Logo.scale-200.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SystemResources\Windows.UI.AccountsControl\Images\Outlook.Theme-Light_Scale-300.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Planet.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d5.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\MicrosoftEdgeSquare44x44.scale-100.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\MapsMedTile.scale-100.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-help-credits.resources_31bf3856ad364e35_10.0.15063.0_en-us_bf809a311cf16bff\credits.rtf.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.15063.0_none_0d07ce77359b6878\SplashScreen.contrast-black_scale-400.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-200.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\9724_24x24x32.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SystemApps\ContactSupport_cw5n1h2txyewy\Assets\TinyTile.scale-400_contrast-black.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\Square310x310Logo.scale-125.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\images\WalletSquare150x150Logo.scale-200.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-20_altform-colorize.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-96.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTile.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\AppxManifest.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-125.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\SQL\EN\SqlPersistenceProviderLogic.sql.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-256_contrast-white.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-60_altform-unplated_contrast-white.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-40_altform-unplated_contrast-white.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-48.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-30_altform-unplated.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6478_24x24x32.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SystemApps\ContactSupport_cw5n1h2txyewy\Assets\WideTile.scale-100_contrast-black.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\starttile.dualsim1.wink.small.scale-150.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c\SkypeApp\Assets\delete_12x12.scale-125.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5666_32x32x32.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\ReadingListImage360x270.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\WideTile.scale-200.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\198.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-black_scale-200.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.15063.0_none_2bd1e3a1cfd67be0\AppsRtl.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\OneConnectStoreLogo.scale-125.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.15063.0_none_26d246aabc4934f8\RenderingControl.xml.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\SystemResources\Windows.SystemToast.Calling\Images\Ignore.scale-300.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\WinSxS\x86_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_10.0.15063.0_none_680fda7bb57ad4b8\headerGRADIENT_Tall.gif.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupLargeTile.scale-100.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\Logo.scale-200.png.d7fbc8fb-4ba8-4e28-bf84-d64cab96cc4c cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe"C:\Users\Admin\AppData\Local\Temp\cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:888