Analysis
-
max time kernel
152s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 06:32
Static task
static1
Behavioral task
behavioral1
Sample
9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe
-
Size
614KB
-
MD5
4ff1701c87bbe196868574a141261708
-
SHA1
c17fb32dac1680e324f4fde436281927aedb10d5
-
SHA256
9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a
-
SHA512
84b3a01deac6822cc2656d78f44764652e7a08a74aa2aaad06dd8a6d4478d6a3324128e327698edb027ad1d05476e41f8d57db6c10a611927e44300f8e40e95b
-
SSDEEP
6144:+rZSYomWS//JmcZiWE58TR45SYomWS//JmcZiWE58TR4u:dYomWS//JmcE2YomWS//JmcE
Malware Config
Signatures
-
Drops file in Drivers directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\de-DE\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\drivers\en-US\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\drivers\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\de\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsonyu.inf_amd64_neutral_45152a8a9362fb82\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO2600T.XML 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\_Default\StarterE\license.rtf 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\MUI\0407\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomeBasicN\license.rtf 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00d.inf_amd64_neutral_dd61103f3a2743d4\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001f\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwifibus.inf_amd64_neutral_9d0740f32ce81d24\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\com\en-US\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomeBasic\license.rtf 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomePremiumE\license.rtf 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnky008.inf_amd64_neutral_9f6abc54cbf095f2\Amd64\KYW7QUR7.XML 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\Enterprise\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\Professional\license.rtf 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\spp\tokens\ppdlic\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\Microsoft.PowerShell.ConsoleHost.dll-Help.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnfx002.inf_amd64_neutral_b6dd354531184f64\Amd64\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc4340t.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnky307.inf_amd64_ja-jp_e40bd14f18e8ff7d\Amd64\KYW7QUR6.XML 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomePremiumE\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomeBasicE\license.rtf 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaca00f.inf_amd64_neutral_f7f7e179d99acc58\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0804\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-Unimodem-Config\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky003.inf_amd64_neutral_fe7ea176f20ab839\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\migwiz\replacementmanifests\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\slmgr\0410\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPW1200T.XML 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\SysWOW64\icsxml\osinfo.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\eval\HomePremiumE\license.rtf 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\000e\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmcd.inf_amd64_neutral_49212f5920298e45\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc5.inf_amd64_neutral_2270382453de2dbb\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc4400t.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnkm003.inf_amd64_neutral_48652cda3bb15180\Amd64\koc451X.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnnr003.inf_amd64_neutral_c07c33bfb5764bdb\Amd64\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc00b.inf_amd64_neutral_3338d41663aad5fa\Amd64\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomeBasicE\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmags64.inf_amd64_neutral_e68956e24e287714\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd1360t.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\de-DE\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\af9035bda.inf_amd64_neutral_aa11aa34552d1d4d\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\Professional\license.rtf 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomePremiumE\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\SysWOW64\WCN\fr-FR\Add_a_device_or_computer_to_a_network_usb.rtf 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_neutral_7a5f47d3150cc0eb\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc002.inf_amd64_neutral_fdb6f2e252435905\Amd64\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\EnterpriseE\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\ProfessionalN\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmbsb.inf_amd64_neutral_56a9f6bceeec7f72\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasicN\license.rtf 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsier.inf_amd64_neutral_622ad8125bbeeda8\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky305.inf_amd64_ja-jp_4d77cc4802b17ec3\Amd64\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00w.inf_amd64_neutral_d4c93bb2fbf75723\Amd64\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\System32\LogFiles\WMI\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\Minesweeper\it-IT\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\VideoLAN\VLC\plugins\spu\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Windows Photo Viewer\it-IT\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Perspective.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\connectionmanager_dmr.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\gadget.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Common Files\System\msadc\es-ES\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL001.XML 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Internet Explorer\SIGNUP\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.CRT 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\modules\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\connectionmanager_dmr.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\fr-FR\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPIRM.XML 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Windows Mail\it-IT\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382968.JPG 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Windows Sidebar\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Internet Explorer\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384885.JPG 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1036\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382960.JPG 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\STOPICON.JPG 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL048.XML 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.jpg 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\StarterNotificationDescriptors.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\gadget.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL065.XML 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Windows Journal\es-ES\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\gadget.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackgroundRTL.jpg 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTIRM.XML 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-soundrec-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1d7a67889aaac533\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..timezones.resources_31bf3856ad364e35_6.1.7601.17514_it-it_6e4620a36290fd66\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..i-prnfldr.resources_31bf3856ad364e35_6.1.7600.16385_es-es_881250703e717c28\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dot3svc_31bf3856ad364e35_6.1.7601.17514_none_c99214378a23d63b\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..overy-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_36533c7ab71f6461\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..rendering.resources_31bf3856ad364e35_11.2.9600.16428_en-us_ef3f7e95187b579b\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_eb806fad92a5e1bd\license.rtf 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..rkprofile.resources_31bf3856ad364e35_6.1.7600.16385_it-it_95e5bdcb3ea60686\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\assembly\GAC_MSIL\ehiWUapi\6.1.0.0__31bf3856ad364e35\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..panese-imejpimm32if_31bf3856ad364e35_6.1.7601.17514_none_5b51d9f34031ebdd\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..onitoring.resources_31bf3856ad364e35_6.1.7600.16385_es-es_fe097beb1d8df986\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-escalate.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ad6cea24cba1a390\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..component.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c155295e758629d9\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..ty-client.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ff212240b76bfbc4\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_mdmtkr.inf_31bf3856ad364e35_6.1.7600.16385_none_ade8da810f91972b\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..e-ehdebug.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6c5834f4c9a4b21b\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ipconfig_31bf3856ad364e35_6.1.7600.16385_none_a82ee2a7319fa8f8\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-spinf_31bf3856ad364e35_6.1.7600.16385_none_b9958864921e30c1\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..nttoolapi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_13ef808512356f82\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..-currency.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2d42a6783ff36048\gadget.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1dcea8f1f1b0f47d\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-v..ption-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6e1a2fba33c435d8\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.Linq.resources\3.5.0.0_it_b77a5c561934e089\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_hal.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_994af506c76ffc80\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..structure.resources_31bf3856ad364e35_6.1.7600.16385_it-it_d6d9ff4373860161\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sxs.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4d917c829fa63be1\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..cationcompatibility_31bf3856ad364e35_6.1.7600.16385_none_8ea960f4e5c9adc2\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wab-core.resources_31bf3856ad364e35_6.1.7600.16385_de-de_635c2b13c25f3b81\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\0e5bae8f265fbbbf53e8ca79d159cd6d\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..olorspaceconverters_31bf3856ad364e35_6.1.7601.17514_none_c3ab12c1c499b774\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\f971acbc25b64dfe4d70e5b25837c780\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..readwrite.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_54958cbf87ad2335\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-smss.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_6f2f7241362c0294\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..inkwatson.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4e43d552640bca7d\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-themeui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_9c6be9757a591588\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_prnrc004.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5449a03c366fb65a\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\Web\Wallpaper\Scenes\img28.jpg 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-magnify.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f404c54ff94d14fc\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-at.resources_31bf3856ad364e35_6.1.7600.16385_es-es_bbd233571ba32958\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-printing-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7d56d2d00c3f7e96\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.WebSockets\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-alttab.resources_31bf3856ad364e35_6.1.7600.16385_it-it_cb29c964c7cbfd2f\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ff6f7ad3c2f5987e\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f9a9298b9835726a\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_netxex64.inf.resources_31bf3856ad364e35_6.1.7601.17514_it-it_726b53a6269c3393\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0000000010\9.0.0\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-pnphotplugui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_319deb101e79659c\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_prnep00l.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_12272e88b3e66c2d\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-n..sh-helper.resources_31bf3856ad364e35_6.1.7600.16385_it-it_d0d72f2fd04aa217\Rules.System.NetTrace.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..rtmonitor.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_78fa9a5307f2b9c6\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_caa8f7c0e409a91f\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rpc-http_31bf3856ad364e35_6.1.7601.17514_none_fe1ef25f55f373ef\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-telnet-server-tlntsess_31bf3856ad364e35_6.1.7600.16385_none_05ebf19ca2304436\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\msil_system.management.i..mentation.resources_b77a5c561934e089_6.1.7601.17514_fr-fr_2b9541dfcd6e2e47\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_adp94xx.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_7d1934d0258df2c9\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..river-rll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b6efab6cbc3c4985\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..et-server.resources_31bf3856ad364e35_6.1.7600.16385_es-es_38fb994cd0e81f87\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_6.1.7601.17514_none_61acd141e5332baf\ConnectionManager.xml 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ncsi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_58dec972d8a9cb4e\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-processmodel.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f85da006b6717d75\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MUI\0C0A\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe File created C:\Windows\winsxs\amd64_microsoft-windows-r..erycenter.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_862962138f072ac3\ÄÅØÈÔÐÀÒÎÐ.txt 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EORCUJXLNELSWAO\shell\open 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EORCUJXLNELSWAO\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\63596J48vG1Qq2M.exe" 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EORCUJXLNELSWAO 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EORCUJXLNELSWAO\DefaultIcon 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EORCUJXLNELSWAO\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\63596J48vG1Qq2M.exe,0" 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EORCUJXLNELSWAO\shell 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.50027 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.50027\ = "EORCUJXLNELSWAO" 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EORCUJXLNELSWAO\ = "CRYPTED!" 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EORCUJXLNELSWAO\shell\open\command 9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe"C:\Users\Admin\AppData\Local\Temp\9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1664