Analysis
-
max time kernel
122s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
08-11-2022 16:17
Behavioral task
behavioral1
Sample
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe
Resource
win10v2004-20220901-en
General
-
Target
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe
-
Size
62KB
-
MD5
0210847e1ad4692e9f828528711707a0
-
SHA1
c2500c9587a4f68df63b953aff9e4ffc446ece18
-
SHA256
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7
-
SHA512
acf7a1d304bfc032e64cce4dc5e5fec89f41fc3bea864e29cc3efdcaafcf584646e4b15af3d58126fedc4923b85e74b9a95c7ac5415a2539fcdb0cc6fae582b7
-
SSDEEP
768:w0FmBkpKjJH40+R7WC8If/+w5xZd0vBCn2jd/Pudv0ECjWacQGrtV8PKFWcccPc/:wODKd32Zd6vjVPg0JSaQrtVrFXD6B
Malware Config
Signatures
-
Drops file in Drivers directory 3 IoCs
Processes:
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exedescription ioc process File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exedescription ioc process File renamed C:\Users\Admin\Pictures\DisconnectNew.png => C:\Users\Admin\Pictures\DisconnectNew.png.EnCiPhErEd 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File renamed C:\Users\Admin\Pictures\StepSwitch.png => C:\Users\Admin\Pictures\StepSwitch.png.EnCiPhErEd 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe -
Drops startup file 1 IoCs
Processes:
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EOCoth9nO9QJD19.exe" 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe -
Drops file in System32 directory 64 IoCs
Processes:
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\bda.inf_amd64_d32fe6b1c2b7b2a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\c_sslaccel.inf_amd64_ed6849ad81a24c48\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\040c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetLbfo\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmrock.inf_amd64_9b13bcc1f320d1ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\netbvbda.inf_amd64_06bc8afcd2617abf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\npsvctrig.inf_amd64_b98e9a5325075265\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\SysWOW64\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\errdev.inf_amd64_616c5168a5b1807a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnis3t.inf_amd64_9f214efed426c12a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\pci.inf_amd64_66614bed5c0a20d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\usbnet.inf_amd64_9e6bb7a4b7338267\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\SysWOW64\DefaultAccountTile.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmts.inf_amd64_bc07e137c52c529a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TLS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\SysWOW64\@VpnToastIcon.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\c_extension.inf_amd64_7891c7d003f5e96b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtkr.inf_amd64_a8a4ecec7082e1aa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\000a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\SysWOW64\downlevel\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\cdrom.inf_amd64_28c103304ddff3c0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_bxt_p.inf_amd64_8be317e01b44bf5a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmhzel.inf_amd64_e90a0a4c8e15815d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\wdmvsc.inf_amd64_8666ee4da6ad6325\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\hidspi_km.inf_amd64_7e53b3972dc4df20\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmairte.inf_amd64_a99a7ecb03853141\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmosi.inf_amd64_fce30a36dbc4596c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\tsgenericusbdriver.inf_amd64_bcfa5f586783921d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\c_mtd.inf_amd64_2f8cc39571965376\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl004.inf_amd64_189d0189716edeb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\SysWOW64\Nui\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\c_61883.inf_amd64_2c1769df23d261a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms008.inf_amd64_69b5e0c918eab9a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\SysWOW64\sv-SE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Host\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\SysWOW64\@EnrollmentToastIcon.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\lsi_sas3i.inf_amd64_79c7a4d8be0a9744\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmti.inf_amd64_bcde2913bb6ccf3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\scunknown.inf_amd64_90993a57907d9959\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Appx\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl006.inf_amd64_130cd40b355024c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdk.inf_amd64_9e49da794995b361\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmzyp.inf_amd64_19eb30e94285f2a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\c_computer.inf_amd64_aa72c8894a821b32\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcom1.inf_amd64_cfd501781ae941c0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\hidbth.inf_amd64_76fb27776958e530\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_a2dp_snk.inf_amd64_213eeba98cc6f2f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\tape.inf_amd64_bf051ca3546a5bf3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\SysWOW64\F12\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\SysWOW64\he-IL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_7830581a689ef40d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmirmdm.inf_amd64_ba5b77b7d46bc10d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnis5t.inf_amd64_c6e181de81a59b54\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_b6748bc8bb8ccf4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\stexstor.inf_amd64_fefc1160d15aa667\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\ucmucsiacpiclient.inf_amd64_a233292790c69f03\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\c_1394.inf_amd64_cac08af12caec647\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmhaeu.inf_amd64_e0c209c891e162a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\celcglpeinbglpdi.bmp" 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe -
Drops file in Program Files directory 64 IoCs
Processes:
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\PREVIEW.GIF 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSmallTile.scale-125.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\MoviesAnywhereLogoWithTextDark.scale-200.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-ma\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubStoreLogo.scale-125.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarLargeTile.scale-100.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-200_contrast-black.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\THMBNAIL.PNG 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-96.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionLargeTile.scale-400.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\RHP_icons.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d6.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adobe_spinner.gif 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\logo.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-125_contrast-white.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\SmallTile.scale-100.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\SmallTile.scale-125.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-150_contrast-black.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\cstm_brand_preview.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-96.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80_altform-lightunplated.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-20.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-60_altform-unplated.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\Doughboy.scale-250.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-24_altform-lightunplated.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\uk-ua\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-64.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_altform-unplated_contrast-white.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\PREVIEW.GIF 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_contrast-white.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-60_altform-unplated.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\en-GB\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\FileSway32x32.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarMediumTile.scale-150.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarLargeTile.scale-100.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxWideTile.scale-125.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxMediumTile.scale-100.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FFFFFF-0.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSmallTile.scale-150.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-20_altform-unplated.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-36_contrast-white.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookSmallTile.scale-150.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-48.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-150.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-16.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-125_contrast-black.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe -
Drops file in Windows directory 64 IoCs
Processes:
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vsmb_31bf3856ad364e35_10.0.19041.153_none_0cfd7decc29a2696\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\403-4.htm 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mfds_31bf3856ad364e35_10.0.19041.264_none_836ffae97c5e6896\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smbhelperclasses_31bf3856ad364e35_10.0.19041.1_none_a02e3303758007d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_netsstpa.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_084d6fe3e8ab4ae2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directx-warp10_31bf3856ad364e35_10.0.19041.84_none_e206c11c84c9c833\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\TileSmall.scale-100.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-settingsynccore_31bf3856ad364e35_10.0.19041.264_none_5754081f862908dc\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cryptnet-dll_31bf3856ad364e35_10.0.19041.1_none_d75ef8efcf9401ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\Square44x44Logo.scale-400.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pdc-mw_31bf3856ad364e35_10.0.19041.1052_none_97ace0ce224e6958\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnpclean_31bf3856ad364e35_10.0.19041.746_none_7f3b9802dfe53bf8\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Assets\PeopleLogo.targetsize-16_altform-unplated_contrast-white.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bits-perf-v1-counters_31bf3856ad364e35_10.0.19041.1_none_17c681fded11fc67\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceupdateagent_31bf3856ad364e35_10.0.19041.746_none_367d36471bb01f41\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..derninjectionbroker_31bf3856ad364e35_10.0.19041.746_none_1e15455ff63524d9\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_dual_flpydisk.inf_31bf3856ad364e35_10.0.19041.1_none_f0b32619584ad4cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_9e3e509d4c4881e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..infrastructurewinrt_31bf3856ad364e35_10.0.19041.1_none_6057cc74a533c41e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-wbemcore-dll_31bf3856ad364e35_10.0.19041.1266_none_60da30bbc063c699\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\x86_microsoft-windows-security-spp-client_31bf3856ad364e35_10.0.19041.546_none_18779d3752118b2b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-admin-gpedit_31bf3856ad364e35_10.0.19041.572_none_ac0702a9c3d2a173\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mpr.resources_31bf3856ad364e35_10.0.19041.1_en-us_70769b7fd35d9fbd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..tion-relaytransport_31bf3856ad364e35_10.0.19041.746_none_1ad1c2967b0d8382\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_7847c586349dcaf4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_system.web.mobile_b03f5f7f11d50a3a_4.0.15805.0_none_32f5f6adbb426e52\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..t-library.resources_31bf3856ad364e35_10.0.19041.1_en-us_1a8672d636923f63\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\OfflineTabs.html 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\pdferrordisabledforregion.html 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-snmp-common-api_31bf3856ad364e35_10.0.19041.1_none_f361acf942b0e457\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\square150x150logo.scale-200_contrast-black.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_hyperv-hvsocketapi_31bf3856ad364e35_10.0.19041.546_none_017fe414680118f2\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mfmpeg2srcsnk_31bf3856ad364e35_10.0.19041.208_none_29ce1a0c2d040f1a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\InputApp\Assets\SquareLogo150x150.scale-200.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_dual_ntprint.inf_31bf3856ad364e35_10.0.19041.264_none_c2ff528ca8752daf\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing3d-winrt-core_31bf3856ad364e35_10.0.19041.1202_none_0aef02ab2b21e0a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2\Windows Notify System Generic.wav 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.19041.153_none_59d1094dec9b8480\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\msil_system.servicemodel_b77a5c561934e089_10.0.19200.110_none_c3312681faab1241\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_11.0.19041.1_en-us_31c3a5c4935d8cb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..rsist-rll.resources_31bf3856ad364e35_10.0.19041.1_en-us_1c42d432695fc301\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.WebSockets\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-font-truetype-impact_31bf3856ad364e35_10.0.19041.1_none_ff3f122f126e89bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ngshandlers-display_31bf3856ad364e35_10.0.19041.153_none_c114ae7ca97df3cf\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.19041.1_sl-si_501c569aded41a0a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_windows-defender-events_31bf3856ad364e35_10.0.19041.1_none_128fec88314218ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-k..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_en-us_7e7aead557153c38\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..handlers-appcontrol_31bf3856ad364e35_10.0.19041.1_none_470e1cde18267791\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.19041.1023_da-dk_81985656bd2d9e84\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-36_altform-unplated_contrast-white.png 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bcp47languages_31bf3856ad364e35_10.0.19041.84_none_920d6af904f11d27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..owsercore.resources_31bf3856ad364e35_10.0.19041.1151_en-us_721c9172d4fd5bef\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-f12diagnosticstap_31bf3856ad364e35_11.0.19041.1_none_3fed597ac93e3a97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_hu-hu_fd01b7045f001002\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.746_none_7a0308f7ffc334d5\Resource Monitor.lnk 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities\v4.0_4.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_el-gr_24ebd5f0bda69514\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.19041.746_none_9ebd3ef9f0c794b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-capisp-dll_31bf3856ad364e35_10.0.19041.1_none_924df7bd110457f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..band-experience-api_31bf3856ad364e35_10.0.19041.264_none_e1c9ae689bcae321\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-activexproxy_31bf3856ad364e35_10.0.19041.1_none_c7ff40f389a7dd11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cngcredui-dll_31bf3856ad364e35_10.0.19041.1_none_08c65761b991c902\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-winproviders-assoc_31bf3856ad364e35_10.0.19041.746_none_1528595196b6dc66\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe File created C:\Windows\WinSxS\amd64_windows-media-ocr_31bf3856ad364e35_10.0.19041.1052_none_7a6f626a5f7a171a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe -
Modifies registry class 10 IoCs
Processes:
0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "MAFFWRYFBIBLZCO" 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MAFFWRYFBIBLZCO\ = "CRYPTED!" 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MAFFWRYFBIBLZCO\shell\open\command 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MAFFWRYFBIBLZCO\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EOCoth9nO9QJD19.exe" 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MAFFWRYFBIBLZCO 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MAFFWRYFBIBLZCO\DefaultIcon 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MAFFWRYFBIBLZCO\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EOCoth9nO9QJD19.exe,0" 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MAFFWRYFBIBLZCO\shell 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MAFFWRYFBIBLZCO\shell\open 0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe"C:\Users\Admin\AppData\Local\Temp\0e165fe4353331710f8db102e7bf648b5e06f92ee87138ad03870fe2194f4ad7.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:4948