Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2022 04:32
Behavioral task
behavioral1
Sample
e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe
Resource
win10v2004-20220812-en
General
-
Target
e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe
-
Size
7KB
-
MD5
06ef31e62e5b10e2bacae0493e98e836
-
SHA1
0d8bb8222f1a324e048fb293011db5621ea8299c
-
SHA256
e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923
-
SHA512
5fecd97757798110269f68db72882e62ec8266f2c7f68e1828b836f8e390fb630636942b7e967d22259377d57e122bf2d6102ec5f86be3804ff8f2271c4c25de
-
SSDEEP
96:lUZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExXWVLIgKc2qerbBZxuPP:Kzdrr1FG1WDCgmjPZXWV0ckrbBaGMUA
Malware Config
Signatures
-
Detected Xorist Ransomware 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3416-133-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exedescription ioc process File renamed C:\Users\Admin\Pictures\SplitUnregister.png => C:\Users\Admin\Pictures\SplitUnregister.png.EnCiPhErEd e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File renamed C:\Users\Admin\Pictures\StopResize.png => C:\Users\Admin\Pictures\StopResize.png.EnCiPhErEd e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe -
Processes:
resource yara_rule behavioral2/memory/3416-132-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/3416-133-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\14Fc59lHJ6Lr98g.exe" e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe -
Drops file in Program Files directory 64 IoCs
Processes:
e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosMedTile.contrast-black_scale-100.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\7739_32x32x32.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-250.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-250.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-16_altform-unplated_contrast-black.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosAppList.scale-100.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-30_contrast-white.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-32_altform-unplated.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_EyeLashEye.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FlagToastQuickAction.scale-80.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyView-Dark.scale-100.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSplashScreen.scale-125_contrast-black.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d0.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb_new.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover_2x.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsWideTile.scale-100.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-16_altform-lightunplated.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-32_altform-unplated.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileLargeSquare.scale-200.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72_contrast-white.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\StoreLogo\PaintApplist.scale-125.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-40.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\add-comment.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files\VideoLAN\VLC\plugins\visualization\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.pdf e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\DeleteToastQuickAction.scale-80.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-100.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files (x86)\Common Files\System\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_ReptileEye.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\THMBNAIL.PNG e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-400.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-colorize.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\StoreLogo.scale-100.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsSmallTile.scale-100.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-32.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-16_altform-colorize.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorWideTile.contrast-white_scale-200.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96_altform-unplated_devicefamily-colorfulunplated.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\adobe_sign_tag_retina.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\ThirdPartyNotices\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupLargeTile.scale-125.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxMediumTile.scale-100.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe -
Drops file in Windows directory 64 IoCs
Processes:
e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exedescription ioc process File opened for modification C:\Windows\ImmersiveControlPanel\images\Gaming.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_it_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I0cd65b90#\cdb4ab324ded8baddb0daf8a2d757ca5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\Boot\PCAT\cs-CZ\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\IdentityCRL\production\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.contrast-black_scale-150.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFramework.Resources\3.0.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\System.Workflow.Activities.Resources\3.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Resources\3.0.0.0_it_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S0f8e494c#\6d056f3fff70a663755a1120dd61d6e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\diagnostics\system\BITS\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\diagnostics\system\Networking\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.scale-200.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.v9.0\9.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.Services.Resources\3.5.0.0_ja_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\Boot\EFI\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\wide.Personalize.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\INF\usbhub\0000\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Sa56e3556#\a0e4dc4d7b18b0bcf31e3df2eef25553\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\PresentationUI.Resources\3.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.Services.Resources\3.5.0.0_es_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\Boot\Fonts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\IME\IMEKR\HELP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\TileSmall.scale-400.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\apppatch\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S54faafb0#\677c75c2bda4bd3c926237a7a0224b43\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\diagnostics\scheduled\Maintenance\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\INF\.NET Data Provider for SqlServer\0407\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\System.Web.Extensions.Design.Resources\3.5.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P655586bb#\6fdda83217c1dd40aa3000f46077a8af\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-125.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\INF\PERFLIB\0409\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\System.Web.Extensions.Design.Resources\3.5.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\UIAutomationTypes.Resources\3.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\System.Workflow.ComponentModel.Resources\3.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W708fc392#\09b91f03d16fc39bc49c0ed85b6903a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pcd26229b#\e41ca40f75ea278df401c7edb53e80e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\diagnostics\system\Video\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\System.Configuration.Install.Resources\2.0.0.0_es_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C26a36d2b#\cc60c54c3dde798a43317ec502c0ca47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\Boot\EFI\sv-SE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\System.Security.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\System.Speech.Resources\3.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\System.Web.Extensions.Design\3.5.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\WindowsBase.Resources\3.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd75d181a#\a59eafc66ceb93baa9032d0ec04afd19\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\diagnostics\system\WindowsMediaPlayerPlayDVD\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.Entity.Design.Resources\3.5.0.0_fr_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\System.Management.Automation.Resources\1.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-150.png e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\Boot\PCAT\hu-HU\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\diagnostics\system\Keyboard\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\diagnostics\system\Printer\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\INF\.NET CLR Data\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.Entity.Design.Resources\3.5.0.0_es_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe -
Modifies registry class 10 IoCs
Processes:
e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CWAFIPTICWNLKOE e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CWAFIPTICWNLKOE\ = "CRYPTED!" e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CWAFIPTICWNLKOE\DefaultIcon e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CWAFIPTICWNLKOE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\14Fc59lHJ6Lr98g.exe,0" e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CWAFIPTICWNLKOE\shell\open\command e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CWAFIPTICWNLKOE\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\14Fc59lHJ6Lr98g.exe" e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CWAFIPTICWNLKOE\shell e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CWAFIPTICWNLKOE\shell\open e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "CWAFIPTICWNLKOE" e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe"C:\Users\Admin\AppData\Local\Temp\e5f67a8f1c6042110fe98d4943c04c5a2eabca922719354cf68b9e9cb849b923.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:3416