Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
203s -
max time network
207s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 22:07
Static task
static1
Behavioral task
behavioral1
Sample
ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
-
Target
ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe
-
Size
108KB
-
MD5
a13993d055dc0f9c3de41e115beceb40
-
SHA1
9787343996c078f4617308baa35c1d871c6b4427
-
SHA256
ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381
-
SHA512
1279ad99f558d3434fabf23b13143363d233859107b1e06b3f3cbc54ca9580413c4f7ab1473000915cbcd04d6465a49de6715b98f9026a3b34b8072fdc113851
-
SSDEEP
1536:EE+pYZuwo8FBM3sOBb6hXvZ46ycV8xm7SL1ToisSzJEyIwXf5CD3o4c:EE+pYZuwoPRBu34bmg/sSzOyzxC7o4
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened (read-only) \??\B: ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\regedit.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateBroker.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{4CA8DFAB-80A0-43FC-AC78-FBACDED770CF}\chrome_installer.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\7-Zip\7zG.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.165.21\MicrosoftEdgeUpdateSetup_X86_1.3.165.21.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdate.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe -
Drops file in Windows directory 35 IoCs
description ioc Process File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\splwow64.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\winhlp32.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Boot\PCAT\memtest.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\explorer.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\debug\blastcln.log ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\HelpPane.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\notepad.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\bfsvc.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\hh.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\write.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\rdrservicesupdater.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe"C:\Users\Admin\AppData\Local\Temp\ad1c818040e1a8cabe8f3221d659eca0df5311016d0d64eb5c6b8eabf487f381.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4028