Analysis
-
max time kernel
153s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 04:30
Behavioral task
behavioral1
Sample
5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe
Resource
win7-20221111-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe
-
Size
7KB
-
MD5
31b39332874eca4bca19319073c479e2
-
SHA1
2038839be53dc9ef2d3981d2ddbfb8ff5cfb2eaf
-
SHA256
5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a
-
SHA512
8347c8b63d03d1248e1b505ca171837a0a73237183b14ab2044336013c06cc0cc8f651baf33b5009b4411ad40000e89e423463f3f7192e5a69e5ed388b13c301
-
SSDEEP
96:FHZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExs3aWOjj7jRmW+1xSqMB:9zdrr1FG1WDCgmjPZs3TgXMlSqMUA
Score
10/10
Malware Config
Signatures
-
Detected Xorist Ransomware 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1840-132-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral2/memory/1840-133-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 8 IoCs
Processes:
5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exedescription ioc process File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe -
Processes:
resource yara_rule behavioral2/memory/1840-132-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/1840-133-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0g81EtiCH2QMn87.exe" 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe -
Drops file in System32 directory 64 IoCs
Processes:
5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\c_barcodescanner.inf_amd64_266a07997c075b30\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcxpv6.inf_amd64_46a3b42507e9d29e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\MUI\0407\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\61883.inf_amd64_789f35bee584a939\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\cdrom.inf_amd64_28c103304ddff3c0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\rdvgwddmdx11.inf_amd64_e8336336d081cc11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\wpdmtp.inf_amd64_42b97498c7087292\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\icsxml\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Examples\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\1394.inf_amd64_a08737ea39f5790b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\cht4sx64.inf_amd64_3a69b9b79f49eb50\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\c_smartcard.inf_amd64_bf5afc5892966e30\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\setup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\winrm\0411\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fscopyprotection.inf_amd64_9c108d8ac558a80d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\c_receiptprinter.inf_amd64_7952e4baaee88d58\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtkr.inf_amd64_a8a4ecec7082e1aa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_7f701cb29b5389d3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MMAgent\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\winrm\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\et-EE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcomp.inf_amd64_bf289615d063c627\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl005.inf_amd64_d9886a7bbe9e55ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl009.inf_amd64_3bab34655afeb7e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmomrn3.inf_amd64_c2314613ba3f3585\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmrock5.inf_amd64_e485f7ac03009434\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_0e2452f597790e95\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\DiagSvcs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\usbcciddriver.inf_amd64_400a61104320a399\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\wmbclass_wmc_union.inf_amd64_a02e4111c770770d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\Speech\Common\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Host\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\acpi.inf_amd64_605a5cafbbd86f6a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnttte.inf_amd64_f017e7b18ec67a97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_8a737d38f201aeb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\tsusbhub.inf_amd64_bd91a147ab4ebf1c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\IME\IMEKR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0021\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\c_cdrom.inf_amd64_f08f2fe1cde58aef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\hidirkbd.inf_amd64_20ad4886826af1d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnis1u.inf_amd64_64035dd8a7571ba7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmolic.inf_amd64_7f84203a67c210e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_c62e9f8067f98247\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnge001.inf_amd64_1daeee8f3aa30fcb\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe -
Drops file in Program Files directory 64 IoCs
Processes:
5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exedescription ioc process File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireWideTile.scale-125.jpg 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalStoreLogo.scale-125_contrast-white.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-150.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\es-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files\Windows Mail\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSmallTile.scale-400.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-250.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-72_contrast-black.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_altform-unplated_contrast-black.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarMediumTile.scale-100.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\1850_20x20x32.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageSmallTile.scale-150.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256_altform-lightunplated.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-32.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-20_altform-unplated.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxAccountsLargeTile.scale-100.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\LargeTile.scale-125.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-48.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-30_altform-lightunplated.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-150_contrast-white.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-100_contrast-black.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-400_contrast-white.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-40.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\MedTile.scale-100.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\SmallTile.scale-200.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\WinMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-256_altform-lightunplated.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\[email protected] 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fr-CA\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\SmallTile.scale-100.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-36_altform-unplated.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7cb.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\PREVIEW.GIF 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\2.jpg 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageLargeTile.scale-100_contrast-black.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailLargeTile.scale-100.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-256_contrast-black.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-64_contrast-white.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-80_altform-lightunplated.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-60_altform-unplated.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PlaceCard\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\stop_collection_data.gif 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-200_contrast-high.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-300.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-125_contrast-white.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCache.scale-125.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\PreviewMailList.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe -
Drops file in Windows directory 64 IoCs
Processes:
5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-client-li..pgrade-subscription_31bf3856ad364e35_10.0.19041.1_none_07600fc1c7993163\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobesettings-main.html 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-controlpanel-adm_31bf3856ad364e35_10.0.19041.1_none_e98be3c5745ea859\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\diagnostics\system\IEBrowseWeb\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\Help\mui\0407\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\IME\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.82_none_2358a116979cc599\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_39a4d63e07cea862\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..yenhancementservice_31bf3856ad364e35_10.0.19041.906_none_6aea8cda8a4aa9eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_bg-bg_36e6bc5fe8ecffc2\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.resources\v4.0_4.0.0.0_de_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1_bg-bg_35bdba3cb0be21ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\i_info.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..winmmbase.resources_31bf3856ad364e35_10.0.19041.1_it-it_13888cbc331abd06\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars37.contrast-white_scale-200.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-data-pdf.resources_31bf3856ad364e35_10.0.19041.1_es-es_5da90a75e4a78816\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..migration.resources_31bf3856ad364e35_10.0.19041.1_es-es_a08178611646de09\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\Devices.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\system.dynamic.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..shandlers.resources_31bf3856ad364e35_10.0.19041.1_it-it_fa4ea439992c7b80\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\502.htm 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Windows\SystemResources\Windows.SystemToast.Calling\Images\Ignore.scale-200.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_c_fsphysicalquotamgmt.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d30786e67f4bd7ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..necoreuap.resources_31bf3856ad364e35_10.0.19041.117_en-us_0f4e5cc52b2ff016\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..srecorder.resources_31bf3856ad364e35_10.0.19041.1_en-us_83c5db5e28eaad0a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_cs-cz_e1f032fad674dbed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_el-gr_24ebd5f0bda69514\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_10.0.19041.1_it-it_3f23f962ad6356f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_10.0.19041.1_es-es_ebe6f36b4c5f3ce9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..allconfig-installer_31bf3856ad364e35_10.0.19041.964_none_f50adc6b5da9528a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-flacencoder_31bf3856ad364e35_10.0.19041.746_none_f28815d0b7c259ff\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-font-truetype-cambria_31bf3856ad364e35_10.0.19041.1_none_a892ac59a36e1e37\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W69ef49d2#\b96e191cd216a150f00fc95c888a9903\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\AccountSmallLogo.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.1_none_9fbebf8222c20a6d\ResetDriveSquare44x44Logo.scale-100_contrast-white.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Ratings\RatingStars48.contrast-white_scale-200.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..le-server.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_46ff8b5145221a58\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dssec.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_b1533cb7856e51bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\http_500.htm 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..otect-dll.resources_31bf3856ad364e35_10.0.19041.1_it-it_df3798086d6ff0fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Graph\15.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-256_contrast-black.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\Tasks\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolver_31bf3856ad364e35_10.0.19041.264_none_0fd669f7dcbbdcdd\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_45a6c0aa2ed16c7c\invalidcert.htm 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.Services.Client.Resources\3.5.0.0_it_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\20b221b2aa56b5604f519dcf81704999\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\INF\MSDTC Bridge 4.0.0.0\0407\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Device.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..umaninterfacedevice_31bf3856ad364e35_10.0.19041.264_none_fe527beb04a59678\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_es_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cng-hwassist_31bf3856ad364e35_10.0.19041.1_none_2fbbdb1611a7f8ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..agnostics.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_a6f93f22b7261d34\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\i_next.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Windows\Web\Screen\img100.jpg 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_c_fsactivitymonitor.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4942b4ae1c2b2856\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..t-resources-mrmcore_31bf3856ad364e35_10.0.19041.264_none_c9604b1dc0c642f9\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\ResetDriveSquare44x44Logo.scale-100_contrast-white.png 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..trolpanel.resources_31bf3856ad364e35_11.0.19041.1_fr-fr_aef00096e55c8f67\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_mausbhost.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_8fa2df16e62b8ac6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nager-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_34bb15d0aa3fc3a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe -
Modifies registry class 10 IoCs
Processes:
5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.4500\ = "DKWJUSNRKPYSAQA" 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DKWJUSNRKPYSAQA\shell 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DKWJUSNRKPYSAQA\shell\open 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.4500 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DKWJUSNRKPYSAQA\ = "CRYPTED!" 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DKWJUSNRKPYSAQA\DefaultIcon 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DKWJUSNRKPYSAQA\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0g81EtiCH2QMn87.exe,0" 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DKWJUSNRKPYSAQA\shell\open\command 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DKWJUSNRKPYSAQA\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0g81EtiCH2QMn87.exe" 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DKWJUSNRKPYSAQA 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe"C:\Users\Admin\AppData\Local\Temp\5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1840