Analysis
-
max time kernel
96s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 22:07
Static task
static1
Behavioral task
behavioral1
Sample
9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe
Resource
win7-20220901-en
windows7-x64
5 signatures
150 seconds
General
-
Target
9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe
-
Size
68KB
-
MD5
a0d8833944161ac35258639c4b3bbc40
-
SHA1
b6530ee36dc660996a131b3eaa6b828e57d42bc3
-
SHA256
9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6
-
SHA512
2e9b1f1bddc2ca496beb7ca0a8991507a35eac2cefa0fb70b9dafeb557764003e683bff887ce67bd9538e0c7c87bed9841a719792b4c1858e2a693939f6a95df
-
SSDEEP
1536:Evdp7KLDfzpgdRtp7UyUydCzO8y1kYo2G:Evdp7KLPpUfp7UUuJcXo2
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\T: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\A: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\E: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\H: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\J: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\M: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\P: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\G: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\O: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\Q: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\X: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\F: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\R: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\U: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\V: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\Y: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\Z: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\B: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\I: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\K: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\L: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\N: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened (read-only) \??\W: 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\logagent.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\regsvr32.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\stordiag.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\wecutil.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIADAP.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\dfrgui.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\Register-CimProvider.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\SystemUWPLauncher.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\waitfor.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\Com\MigRegDB.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\ARP.EXE 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\dpnsvr.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\perfhost.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\odbcad32.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\recover.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\shutdown.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\takeown.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\regini.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\SearchProtocolHost.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\SecEdit.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\convert.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\getmac.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\mavinject.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\mfpmp.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\ddodiag.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\odbcconf.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesHardware.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\winver.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\net.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\backgroundTaskHost.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\ctfmon.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\cttune.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\mmgaserver.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\msiexec.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\DevicePairingWizard.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\RMActivate.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\sdiagnhost.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\TRACERT.EXE 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\cttunesvr.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesRemote.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\WerFaultSecure.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\wusa.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\sfc.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\ntprint.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\OneDriveSetup.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\dpapimig.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\PresentationHost.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\TpmInit.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\w32tm.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\winrshost.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\PackagedCWALauncher.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\upnpcont.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\autochk.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\dialer.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\SysWOW64\EaseOfAccessDialog.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.167.21\MicrosoftEdgeUpdateOnDemand.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{18F127B1-7EA9-4BC3-9FD3-434ABBAC765F}\MicrosoftEdgeUpdateSetup_X86_1.3.167.21.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1_none_9613f8b833f2e8f1\ByteCodeGenerator.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_d7b5820f5a89765b\f\agentactivationruntimestarter.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\r\audiodg.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.19041.546_none_36dd2ad842e4f8c3\csrss.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\f\WerFault.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\f\hvsirpcd.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..-diagnostic-results_31bf3856ad364e35_10.0.19041.1_none_ded7404f8608d19f\MdRes.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3fe90cdb6667211e\r\wevtutil.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.19041.1266_none_b2317523477fbd48_lsass.exe_682060de 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\f\Taskmgr.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\ApplyTrustOffline.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\f\CallingShellApp.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\f\cmproxyd.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.19041.1_none_fa551ac355d48c7f\fontview.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\f\SysResetErr.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\VmComputeAgent.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\f\vmcompute.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.19041.844_none_3a7392af5414371e\CCG.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.19041.1_none_5c82be53abe61670\PnPUnattend.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1202_none_a27aa61d221bdc5c\wordpad.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1_none_a639f4b392ec604e\autofmt.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.19041.1_none_02027476ea57232f\EhStorAuthn.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.746_none_2703bed0ba809808\f\GamePanel.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.19041.1_none_77274ce3b079d8f5\MicrosoftEdgeCP.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.1_none_735c6874d3056a0a\ofdeploy.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_28f87d0444103fde_fontdrvhost.exe_94bdc76d 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\typeperf.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.19041.1_none_7e723dd43021c2d3\ImagingDevices.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.423_none_6c3451a09cba3850\r\AccountsControlHost.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.19041.746_none_cabafbc5834ab93f\f\DisplaySwitch.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.19041.746_none_915a78ef54321214\SystemSettingsRemoveDevice.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_a40a1f93665b43eb\SndVol.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.153_none_c283d2cf01b0b7d8\r\EoAExperiences.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\Temp\PendingDeletes\ad40614236e5d701629700001815341f.UwfServicingShell.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1_none_da86158885d71eb7\wscadminui.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\tsdiscon.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\r\hvax64.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\AppVShNotify.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.264_none_c1c396da5ea1410f\r\wbengine.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.153_none_3c9b504ec5293ad0\f\WpcTok.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-packageinspector_31bf3856ad364e35_10.0.19041.1_none_207315525e8d1734\PackageInspector.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.746_none_6275453e12708a76\f\recdisc.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.19041.746_none_9043799a93dba365\r\LicenseManagerShellext.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\f\rdpinit.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoftwindows-undockeddevkit.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a22e961d4bcae1e\UndockedDevKit.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4_vds.exe_cb461c29 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.746_none_52411fe22e5a0ca1\TapiUnattend.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.1_none_21cb4db26317f32e\netiougc.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\f\instnm.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.19041.1_none_82a36c559596820a\aspnet_regbrowsers.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.264_none_098f3a6c3a48359d\printfilterpipelinesvc.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_0f44a2d7a5e3a37a\ChtIME.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\f\hvsiproxyapp.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.19041.1237_none_9d556cf140e198b4\f\RecoveryDrive.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_10.0.19041.84_none_cbe289218fb48371\wsqmcons.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5f557b607e14f541\f\ByteCodeGenerator.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15805.0_none_14b25cddc5cbd4b2\ServiceModelReg.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.19041.1_none_7e31b18ab29f9913\TsWpfWrp.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_22b99d078bbc3016\setup_wm.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.19041.746_none_cd77eb91574a2623\sysprep.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\ssh-add.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\user.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_30274b64fe158ec9\f\sxstrace.exe 9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe"C:\Users\Admin\AppData\Local\Temp\9d9af7020d645acfa8575f7069ea9f2bee8010c5adbc5c548358ff9fd2a845a6.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4800