Analysis
-
max time kernel
151s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2022 06:31
Static task
static1
Behavioral task
behavioral1
Sample
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe
-
Size
1.8MB
-
MD5
069170f61d9638c87dab750877065a4a
-
SHA1
21b592ca0ce2e353640893b039eb84dfc7d55d14
-
SHA256
d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5
-
SHA512
bb9c4965c5b67b2f1c6190de6daad373bc4cdc7b4c596d50547408447ba9553904ec4e9c49038ef2ffafc80dffcd43462a67d7097ed4bdcce60356da6e73d218
-
SSDEEP
24576:EnA1KgRYWHEvtd8LHhFJpxjMnA1KgRYWHEvtd8LHhFJpxjJ:D1K5ve1K5v
Score
10/10
Malware Config
Signatures
-
LockFile
LockFile is a new ransomware that emerged in July 2021 with ProxyShell vulnerabilties.
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\drivers\en-US\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmhay2.inf_amd64_e87e378eb673af65\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\storfwupdate.inf_amd64_e57f4de14d125fac\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ServiceSet\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fscontentscreener.inf_amd64_bd1517e25f3e419f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\audioendpoint.inf_amd64_4fc4a632c1490033\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\c_nettrans.inf_amd64_b6d30279f382fa4b\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_a2dp_src.inf_amd64_0bdbb11733d87f9a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_bcc7550a6e285f92\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\acpipmi.inf_amd64_310dc613a7e31ec8\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\c_receiptprinter.inf_amd64_7952e4baaee88d58\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\c_magneticstripereader.inf_amd64_86e291110e37418b\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsun1.inf_amd64_5b6db32fd04403a3\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\oposdrv.inf_amd64_9090a824ce0d0e68\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\c_smartcardfilter.inf_amd64_3573afe136371e51\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_360f6f3a7c4b3433\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\vdrvroot.inf_amd64_5dbe5e81fafe4636\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Examples\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fssystem.inf_amd64_89e15d7e662d6584\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnis5t.inf_amd64_c6e181de81a59b54\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms012.inf_amd64_707d3849370b9d23\Amd64\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\SysWOW64\icsxml\osinfo.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\ko-KR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\en-US\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmeiger.inf_amd64_05ca2a1836c16cab\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_6066bc96a5f28b44\tsprint-PipelineConfig.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\uaspstor.inf_amd64_63788a81c4c628c5\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl005.inf_amd64_d9886a7bbe9e55ca\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\netlldp.inf_amd64_fbd4bbbad72f0e6b\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\Speech\Common\en-US\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\c_sslaccel.inf_amd64_ed6849ad81a24c48\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms004.inf_amd64_c28ee88ec1bd4178\Amd64\unisharev4-pipelineconfig.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_ec11d0ad3c5b262a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\chargearbitration.inf_amd64_a0097842bcc7e487\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_360f6f3a7c4b3433\I386\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Wdac\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\amdsbs.inf_amd64_e2a1e49127fb17ef\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmdp2.inf_amd64_6550f790ed88c7ba\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\wpdfs.inf_amd64_1183fd0f13045f2e\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\hidirkbd.inf_amd64_20ad4886826af1d2\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\multiprt.inf_amd64_a9b96d6c7813082a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\en\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmminij.inf_amd64_a85c8e1fe15a9532\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj6.inf_amd64_5a503c811e650e70\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_ede00b448bfe8099\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\Amd64\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\sisraid4.inf_amd64_65ab84e9830f6f4b\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\smrvolume.inf_amd64_9a3d52a168ca8fee\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0019\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\c_cdrom.inf_amd64_f08f2fe1cde58aef\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmrock5.inf_amd64_e485f7ac03009434\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms012.inf_amd64_707d3849370b9d23\Amd64\MSIPP-pipelineconfig.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\000e\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_fffc54d66d592d52\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\root\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Windows Media Player\Media Renderer\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fi-fi\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Light\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ja-jp\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ro-ro\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL115.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\BuildInfo.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\capture\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Java\jre1.8.0_66\bin\server\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\VideoLAN\VLC\plugins\lua\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL081.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-gb\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\AppxMetadata\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hu-hu\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ja-jp\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lv-LV\View3d\3DViewerProductDescription-universal.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ta-IN\View3d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\BuiltinAgaveCommands.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.Resource\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN097.XML d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_neutral_~_8wekyb3d8bbwe\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-sl\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_hyperv-vmemulateddevices_31bf3856ad364e35_10.0.19041.1202_none_21054615c867a7ca\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.19041.1_pl-pl_1584244fcf77f93a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-coml2_31bf3856ad364e35_10.0.19041.546_none_fbb69b00dcc6f312\f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001045d_31bf3856ad364e35_10.0.19041.1_none_56eef219e79cc448\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..mentmanifests-shell_31bf3856ad364e35_10.0.19041.423_none_9e37e96dfd85e9b1\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pefb7a36b#\c517b5de3ade40af4b13e1c7de729512\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..center-controlpanel_31bf3856ad364e35_10.0.19041.1081_none_bc5d4a6bb8e406db\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castlaunch_31bf3856ad364e35_10.0.19041.746_none_feb9545c78481ff5\f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_dual_ntprint.inf_31bf3856ad364e35_10.0.19041.906_none_c3423ff2a842a4c8\r\Amd64\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\diagnostics\system\Search\en-US\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1023_lv-lv_59d6e4ae3c6412d3\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-feeds-adm_31bf3856ad364e35_7.0.19041.1023_none_ecb4b89dfffceab6\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.appxsetup_31bf3856ad364e35_10.0.19041.1266_none_1810750b8eb9f2ea\AppxBlockMap.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasrtutils.resources_31bf3856ad364e35_10.0.19041.1_en-us_9326bb2bb2334a5b\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt73a1fc9d#\df2df1942cb2ba4282e50ac095a7b932\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.19041.844_none_10a0a60f1ec9cc10\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ers-storage-library_31bf3856ad364e35_10.0.19041.1202_none_4c288dff99c86f55\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a...appxmain.resources_31bf3856ad364e35_10.0.19041.844_en-us_14920372d0be802b\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.746_none_c291aefd01a5d6d6\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..necoreuap.resources_31bf3856ad364e35_10.0.19041.1151_en-us_a603c25e81a37573\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-acledit.resources_31bf3856ad364e35_10.0.19041.1_en-us_df37236660079dfe\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.19041.1_cs-cz_d56485f34e462f43\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..rcluster-clientcore_31bf3856ad364e35_10.0.19041.1202_none_0607b555ed95f3ce\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_dual_bth.inf_31bf3856ad364e35_10.0.19041.1_none_102eb2831eb40ab9\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..ngs-inputcloudstore_31bf3856ad364e35_10.0.19041.746_none_3d56dc154f99b586\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobilepc-sensors-api_31bf3856ad364e35_10.0.19041.746_none_e06926606d9d22f9\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.19041.1_none_cffda9bf5435db63\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Common\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\pris\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devices-lowlevel-winrt_31bf3856ad364e35_10.0.19041.264_none_0852b5eb9c988a9d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-font-truetype-webdings_31bf3856ad364e35_10.0.19041.1_none_64f7d45b602f55b1\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mssign32-dll_31bf3856ad364e35_10.0.19041.1_none_8024db0279cb1a30\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-consolelogon-library_31bf3856ad364e35_10.0.19041.1202_none_fa14df42dc2de4f5\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ftaccount-extension_31bf3856ad364e35_10.0.19041.264_none_dad8256374ab6635\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..em-profile-systemid_31bf3856ad364e35_10.0.19041.746_none_eb57da7956b8ee7a\f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.19041.746_none_e6778e5b0114e5b0\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.264_none_876d2c71ceefefbb\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist.resources_31bf3856ad364e35_10.0.19041.1_hr-hr_a0fdb6d440e8be6f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eapteapext.resources_31bf3856ad364e35_10.0.19041.1_en-us_ddd95f7aaa2d3057\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0002041e_31bf3856ad364e35_10.0.19041.1_none_fa7f1870d9e47f84\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-els-core_31bf3856ad364e35_10.0.19041.746_none_6610480093571de2\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..client-ui-wscollect_31bf3856ad364e35_10.0.19041.1_none_bfa47510d0e31e28\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..xperfcore.resources_31bf3856ad364e35_10.0.19041.1_en-us_fc672a9e5cedd227\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\speech\0416\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-docprop.resources_31bf3856ad364e35_10.0.19041.1_en-us_1d4b4d02c987b391\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-api.resources_31bf3856ad364e35_10.0.19041.1_en-us_d9c7ae36f6e0f219\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-httpproxyhelper_31bf3856ad364e35_10.0.19041.1_none_c2b8a8d826eca989\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..epc-sensors-service_31bf3856ad364e35_10.0.19041.1_none_c814d83d26d83aec\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.746_none_6c16d1714d60fddf\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..kerplugin.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_23f4c1602d97fe43\f\AppxManifest.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..opwindowmanager-api_31bf3856ad364e35_10.0.19041.746_none_be082f599ecc9fb9\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..e-microsofthimalaya_31bf3856ad364e35_10.0.19041.1_none_be23cd6ddb05a43c\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-000a0c00_31bf3856ad364e35_10.0.19041.1_none_d5bbbded717a7a60\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..topservices-rdpbase_31bf3856ad364e35_10.0.19041.1052_none_515a4b606c7b4bc2\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_dual_mdmnis1u.inf_31bf3856ad364e35_10.0.19041.1_none_492bd14ffb7268bb\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File opened for modification C:\Windows\Provisioning\IccidToRegion.xml d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..shape-rll.resources_31bf3856ad364e35_10.0.19041.1_en-us_8d6d7bb7b4c5b85d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u08hwRO9h74aYk9.exe" d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\ = "CRYPTED!" d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u08hwRO9h74aYk9.exe,0" d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open\command d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LOCKFILE d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.LOCKFILE\ = "BPFYNFHUWPHNSDE" d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\DefaultIcon d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe"C:\Users\Admin\AppData\Local\Temp\d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:4684