Analysis
- max time kernel
141s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
16/11/2022, 10:24
Static task
static1
Behavioral task
behavioral1
Sample
650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe
Resource
win7-20221111-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe
- Size 32KB
- Sample221116-mfcc2seb2t
- SHA256 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e
- MD5 7129291fc3d97377200f8a24ad06930a
- SHA1 3f858d2837529e6c973ffa7c26c643e9748e7282
- SHA512 6bd4537a79f839c2964a814eed2fd5c217a969632e267afbe028b04a91a410abd594fb45bf1cba954f8be71e6041a923e932994754fcd46cc71a0bbaf4a932a1
- SSDEEP 384:s+ImkKRjvD/XlXPRPNTEUZytgSisYuaDhcWNDkSIvrfPxLCk9Hf/z:WKRjvTXlXPRNTRZ6hisYugcXjfNCkl
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Azov
A wiper seeking only damage, first seen in 2022.
- Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ResizeConnect.crw => C:\Users\Admin\Pictures\ResizeConnect.crw.azov 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File renamed C:\Users\Admin\Pictures\StopConnect.tif => C:\Users\Admin\Pictures\StopConnect.tif.azov 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File renamed C:\Users\Admin\Pictures\GroupCopy.tiff => C:\Users\Admin\Pictures\GroupCopy.tiff.azov 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File renamed C:\Users\Admin\Pictures\ImportEnter.tiff => C:\Users\Admin\Pictures\ImportEnter.tiff.azov 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File renamed C:\Users\Admin\Pictures\RepairWatch.tiff => C:\Users\Admin\Pictures\RepairWatch.tiff.azov 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Users\Admin\Pictures\RepairWatch.tiff 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File renamed C:\Users\Admin\Pictures\WaitClose.raw => C:\Users\Admin\Pictures\WaitClose.raw.azov 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File renamed C:\Users\Admin\Pictures\ExpandSuspend.raw => C:\Users\Admin\Pictures\ExpandSuspend.raw.azov 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Users\Admin\Pictures\GroupCopy.tiff 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Users\Admin\Pictures\ImportEnter.tiff 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RESTORE_FILES.txt 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\P: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\Q: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\X: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\F: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\E: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\G: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\K: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\W: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\B: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\M: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\O: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\T: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\U: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\V: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\L: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\H: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\I: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\J: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\R: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\S: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\Y: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\Z: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened (read-only) \??\A: 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter_18.svg 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\ui-strings.js 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-256_altform-unplated.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-40_contrast-high.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\rna-main.js 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\Url.model 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\whatsnewsrc\script\RESTORE_FILES.txt 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\ui-strings.js 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\es-es\RESTORE_FILES.txt 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\ResiliencyLinks\Locales\cy.pak.DATA 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-125_contrast-white.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\FileText32x32.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\RESTORE_FILES.txt 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\RESTORE_FILES.txt 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\selector.js 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\ResiliencyLinks\Locales\ar.pak.DATA 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-100_contrast-white.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreBadgeLogo.scale-200.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\editpdf-selector.js 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\RESTORE_FILES.txt 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hr-hr\ui-strings.js 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\RESTORE_FILES.txt 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\RESTORE_FILES.txt 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\MedTile.scale-100.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\ResiliencyLinks\resources.pak.DATA 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\locale\updater_zh_CN.jar 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_zh_CN.jar 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\PowerPivotExcelClientAddIn.rll 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\ui-strings.js 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File created C:\Program Files\Common Files\System\ado\fr-FR\RESTORE_FILES.txt 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-awt.xml 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\en_GB.aff 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72_altform-lightunplated.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\RESTORE_FILES.txt 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-20_altform-unplated.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\RESTORE_FILES.txt 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-30_altform-unplated_contrast-high.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\RESTORE_FILES.txt 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\Staging.DATA 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\ResiliencyLinks\Locales\nl.pak.DATA 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\RESTORE_FILES.txt 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-72_contrast-black.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\ui-strings.js 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-150.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\RESTORE_FILES.txt 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-32.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\AppxManifest.xml 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200.png 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe"C:\Users\Admin\AppData\Local\Temp\650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
PID:1092