Analysis
-
max time kernel
156s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2022 04:32
Behavioral task
behavioral1
Sample
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe
Resource
win10v2004-20220901-en
General
-
Target
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe
-
Size
24KB
-
MD5
04fee8ac111c10660178f4ddbc1f17c9
-
SHA1
57eb1390e539144d87bb4bb3c1c2c5103b50a819
-
SHA256
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84
-
SHA512
c9932414ee16ca5b3bbcb003f4646af23186d23b4ffdee6243638b1dee05ce703f0b45fba17017b87a250ee286a0a47dcf2d5a71524bdd5b86205be1c5bd54fe
-
SSDEEP
384:Dprr1gkDCgSs77F9saOxj8uO9G+WkA5WuHVdR4cWNB:FrVDCu7Ol8uB+WkAn/WX
Malware Config
Signatures
-
Detected Xorist Ransomware 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1952-133-0x0000000000400000-0x0000000000414000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 3 IoCs
Processes:
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exedescription ioc process File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exedescription ioc process File renamed C:\Users\Admin\Pictures\OpenBlock.png => C:\Users\Admin\Pictures\OpenBlock.png.EnCiPhErEd 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File renamed C:\Users\Admin\Pictures\SuspendComplete.png => C:\Users\Admin\Pictures\SuspendComplete.png.EnCiPhErEd 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe -
Processes:
resource yara_rule behavioral2/memory/1952-132-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1952-133-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kg4SQNj6ADx9boQ.exe" 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe -
Drops file in System32 directory 64 IoCs
Processes:
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\c_computeaccelerator.inf_amd64_9d34992b3634b396\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\hidi2c.inf_amd64_aad0f43cb9f97e75\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_cnl.inf_amd64_a60833fda31e9831\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\lsi_sas3i.inf_amd64_79c7a4d8be0a9744\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\c_hdc.inf_amd64_6e00e835fbceac58\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmusrgl.inf_amd64_19bd1d6c2b642b6f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_glk.inf_amd64_7b6c08738ca8a856\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdminfot.inf_amd64_564561a23e05c7ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\hidbth.inf_amd64_76fb27776958e530\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_0e2452f597790e95\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\Speech_OneCore\Engines\SR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\halextpl080.inf_amd64_15251233835ef753\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\hidtelephonydriver.inf_amd64_43fa6b1db642df7e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnttme.inf_amd64_edc94fc65bef3d27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\es-MX\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\PerceptionSimulation\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\percsas2i.inf_amd64_a7f5d94e6751c911\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_0dc913ad00b14824\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\perceptionsimulationsixdof.inf_amd64_3ff016f4df6d2b8a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\umpass.inf_amd64_3daa9a904daf9501\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0008\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcomp.inf_amd64_bf289615d063c627\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\000a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\Com\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmomrn3.inf_amd64_c2314613ba3f3585\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmusrk1.inf_amd64_050c7496eacdd103\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\ro-RO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\th-TH\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\c_mediumchanger.inf_amd64_69ea0d8614286224\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwa.inf_amd64_7cfab61cbab23e11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl003.inf_amd64_6b639ff361f628eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl005.inf_amd64_d9886a7bbe9e55ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\oobe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PKI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\c_usb.inf_amd64_17c270ca25f45542\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\iai2c.inf_amd64_a77c815b2999404d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_f6f0831ba09dd9f5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\LogFiles\Scm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcpq.inf_amd64_3acec385f5d67bdf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmdyna.inf_amd64_d89605b6b478d768\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mvumis.inf_amd64_f0f4d0c799bb854a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\sr-Latn-RS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_e0bae6831f60ea5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_skl.inf_amd64_9d9dbb01837eba23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsmart.inf_amd64_3ca4b12cda56232e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbushid.inf_amd64_fd2fe159a9daf508\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmot64.inf_amd64_2afbe7d3ad20f42a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\c_swcomponent.inf_amd64_f378d70fa39d3577\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\ntprint4.inf_amd64_0958c7cad3cd6075\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\cht4nulx64.inf_amd64_641bf08bee8ac46d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\System32\DriverStore\FileRepository\c_magneticstripereader.inf_amd64_86e291110e37418b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe -
Drops file in Program Files directory 64 IoCs
Processes:
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-125.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-20_altform-fullcolor.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-32_altform-lightunplated.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\Java\jdk1.8.0_66\include\win32\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\Logo.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\Windows Media Player\Media Renderer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageSmallTile.scale-100.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-40.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Speech\en-GB\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files (x86)\Google\Update\1.3.36.71\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.White.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-125_contrast-white.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraMedTile.contrast-white_scale-125.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\Square71x71Logo.scale-200.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-48_altform-unplated.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-100_contrast-white.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsBadgeLogo.scale-100.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-200_contrast-high.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_scale-125.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-60_altform-lightunplated.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-64_altform-lightunplated.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-24_altform-colorize.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-64_altform-lightunplated.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80_altform-unplated_contrast-white.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Google.scale-100.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-125_contrast-black.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\lets-get-started-2x.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\ValueProp_Unknown.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-black_scale-100.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-48.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\StoreLogo.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\Microsoft Office\root\Office16\3082\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-96_contrast-black.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SmallTile.scale-125.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-256_altform-unplated.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_achievements.targetsize-48.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\cs-cz\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\win32_MoveDrop32x32.gif 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SplashScreen.scale-125.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\animations\OneNoteFirstRunCarousel_Animation2.mp4 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\smsconnect\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsMedTile.contrast-black_scale-100.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Dark.scale-100.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Light.scale-150.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\Microsoft Office\PackageManifests\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\169.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\SmallTile.scale-100.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-60_altform-unplated.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_contrast-black.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-72.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-24_contrast-white.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square71x71Logo.scale-125.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe -
Drops file in Windows directory 64 IoCs
Processes:
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exedescription ioc process File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\perftools\images\i_stop.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directx-dxdiagndll_31bf3856ad364e35_10.0.19041.928_none_944996301d66c5ae\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..tingshandlers-phone_31bf3856ad364e35_10.0.19041.1151_none_6a306bb457aca3a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_dual_mdmbug3.inf_31bf3856ad364e35_10.0.19041.1_none_26a35d6e9232b042\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..mgmt-mdmdiagnostics_31bf3856ad364e35_10.0.19041.153_none_c53a7431a32f351e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..sumercore.resources_31bf3856ad364e35_10.0.19041.1_en-us_7f8460453415fbdc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-prelaunchoptin_31bf3856ad364e35_10.0.19041.746_none_96994acc3ea7c82f\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-theme2_31bf3856ad364e35_10.0.19041.1_none_8ccaf9c8444b9274\img7.jpg 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\Square44x44Logo.targetsize-72_altform-lightunplated.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001040a_31bf3856ad364e35_10.0.19041.1_none_559ace77e877368e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-synccontroller_31bf3856ad364e35_10.0.19041.746_none_fbc7a3f2771c3a2d\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Text.Encoding.Extensions\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Assets\PeopleLogo.targetsize-16_altform-unplated_contrast-black.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_dual_c_sdhost.inf_31bf3856ad364e35_10.0.19041.1_none_ac96b9c2862de85e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_hyperv-worker-control_31bf3856ad364e35_10.0.19041.928_none_ee6c2b1a1f306dd1\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directx-xaudio2_9_31bf3856ad364e35_10.0.19041.1288_none_bb4ae491f259a357\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-feclient_31bf3856ad364e35_10.0.19041.1_none_74cb1eaef6f25b5b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_zh-cn_84cce8c4a491125d\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-internal-bluetooth_31bf3856ad364e35_10.0.19041.153_none_5393ecd0063f2e3d\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..ayingsessionmanager_31bf3856ad364e35_10.0.19041.746_none_6344049ee013f218\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_d34f4fd846c530a1\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.264_none_a93c33a11646a55e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_bg-bg_72e4e16994b25d0f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingconsole_31bf3856ad364e35_10.0.19041.264_none_33eed25981c6dfd1\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.19041.1_none_d0dfb9642de0d432\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..olsclient.appxsetup_31bf3856ad364e35_10.0.19041.1_none_3fb2edd2476a33e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-onecorecommonproxystub_31bf3856ad364e35_10.0.19041.1_none_ec940f9ab15de0f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..lsmonitor.resources_31bf3856ad364e35_10.0.19041.423_en-us_d0ecc834a3f529cd\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-adaptivecards_31bf3856ad364e35_10.0.19041.746_none_700ba19aa8fbc362\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_netfx-perfcounter_dll_b03f5f7f11d50a3a_10.0.19041.1_none_a3125f897c2c87ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\Boot\PCAT\pt-BR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Tpm\v4.0_10.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SystemResources\Windows.SystemToast.Calling\Images\AnswerWithVideo.scale-125.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directml_31bf3856ad364e35_10.0.19041.488_none_911950774fe41ed0\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_fi-fi_c42cdfe7b2b01c1a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\wide.RestrictBackgroundData.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mfcore_31bf3856ad364e35_10.0.19041.264_none_ceba4717b612f0a8\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2\Windows Notify Messaging.wav 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.906_none_a6600355b5f69459\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\InputApp\Assets\BadgeLogo.scale-400.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.19041.1_en-us_07ce13b1a94968b4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management.Activities\v4.0_3.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\SystemResources\Windows.UI.PCShell\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analogcommonproxystub_31bf3856ad364e35_10.0.19041.1_none_be0f28ae3e20eab4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.264_none_2f9647f4d89dc6f5\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..securityhelperclass_31bf3856ad364e35_10.0.19041.1237_none_fadba0d72e0f6638\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Square44x44Logo.targetsize-24_altform-unplated.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..dtransfer.resources_31bf3856ad364e35_10.0.19041.1_en-us_f14479f17dee0232\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wbiosrvc.resources_31bf3856ad364e35_10.0.19041.423_en-us_c99b855b8edbac2b\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wirelesslanhelperclass_31bf3856ad364e35_10.0.19041.746_none_78aa134f0ea95176\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\Square150x150Logo.contrast-black_scale-400.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.844_none_9b62a70f9278f2cd\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-white.searchapp_31bf3856ad364e35_10.0.19041.1_none_2f147508fcb33106\SmallTile.scale-125.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ets.icons.searchapp_31bf3856ad364e35_10.0.19041.1_none_ceba36fd1b479c4c\WideTile.scale-200.png 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ntsbroker.resources_31bf3856ad364e35_10.0.19041.1_en-us_cd5e1703fb559393\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-tsappsrv-component_31bf3856ad364e35_10.0.19041.746_none_4ccdbb3d514ecb6b\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..localsessionmanager_31bf3856ad364e35_10.0.19041.1266_none_1a0aa046bfbc05b6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1052_none_b39097e5dc722fb4\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\diagnostics\system\Device\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..o-mmecore-winmmbase_31bf3856ad364e35_10.0.19041.1_none_d23d391ffec1befe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.264_none_87b4b95ab967b582\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe -
Modifies registry class 10 IoCs
Processes:
9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kg4SQNj6ADx9boQ.exe" 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\ = "CRYPTED!" 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\shell\open\command 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kg4SQNj6ADx9boQ.exe,0" 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\shell 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\shell\open 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "QMVTCUODNBQPFQJ" 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\DefaultIcon 9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe"C:\Users\Admin\AppData\Local\Temp\9a51c861cd571b5cdc58828ec0879966182d754c0afdcb531b0c929bea300e84.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1952