Analysis
- max time kernel
142s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2022, 05:39
Static task
static1
Behavioral task
behavioral1
Sample
81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe
- Size 210KB
- Sample221113-gcagdsae82
- SHA256 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41
- MD5 0a8a8d7d504c21ca27d8bca620a46595
- SHA1 23787a4bc091c821543a54b86d91d24dee9455bd
- SHA512 cf3be5331092e85934184549f778f5b6243e5e600c9359f8f06504ee44ac331018f7b73a940ee990196f72c40deda8db0155fa3aa82abbad9b5d64b958c370d6
- SSDEEP 6144:rXs93PTbfYUmF3V62aOpBZw9M9ZTcCFLuU:rXs9fqTwQTVh
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Azov
A wiper seeking only damage, first seen in 2022.
- Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SplitConnect.tif => C:\Users\Admin\Pictures\SplitConnect.tif.azov 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File renamed C:\Users\Admin\Pictures\UnlockUnregister.crw => C:\Users\Admin\Pictures\UnlockUnregister.crw.azov 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File renamed C:\Users\Admin\Pictures\UseRename.raw => C:\Users\Admin\Pictures\UseRename.raw.azov 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File renamed C:\Users\Admin\Pictures\DebugUndo.png => C:\Users\Admin\Pictures\DebugUndo.png.azov 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File renamed C:\Users\Admin\Pictures\ExpandProtect.crw => C:\Users\Admin\Pictures\ExpandProtect.crw.azov 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File renamed C:\Users\Admin\Pictures\GrantOut.raw => C:\Users\Admin\Pictures\GrantOut.raw.azov 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Users\Admin\Pictures\GrantUse.tiff 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File renamed C:\Users\Admin\Pictures\GrantUse.tiff => C:\Users\Admin\Pictures\GrantUse.tiff.azov 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\H: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\J: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\O: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\P: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\N: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\Q: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\S: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\T: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\A: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\F: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\G: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\I: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\Y: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\R: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\U: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\W: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\E: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\K: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\L: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\M: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\B: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\V: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened (read-only) \??\X: 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.dub 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\db2v0801.xsl 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\sr-cyrl-cs\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected] 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\ui-strings.js 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-nodes.xml 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-200.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_hi.json 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\v8_context_snapshot.bin.DATA 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeLargeTile.scale-100.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\media_poster.jpg 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Beta.msix.DATA 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\cacerts 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSplashScreen.scale-400_contrast-black.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-200.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxWideTile.scale-100.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_gridview_selected.svg 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-60_altform-lightunplated.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\duplicate.svg 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\ui-strings.js 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Fonts\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\WideTile.scale-100.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteWideTile.scale-125.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_altform-unplated_contrast-white.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\Views\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\Mozilla Firefox\install.log 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-125.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_LogoSmall.targetsize-16_altform-unplated.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookLargeTile.scale-150.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-125_contrast-white.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteWideTile.scale-400.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-125.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\stickers\word_art\sticker22.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\RESTORE_FILES.txt 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\es.pak 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\MedTile.scale-100_contrast-white.png 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe"C:\Users\Admin\AppData\Local\Temp\81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
PID:916