Analysis
-
max time kernel
151s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 20:29
Behavioral task
behavioral1
Sample
28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
General
-
Target
28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe
-
Size
391KB
-
MD5
1ee3e67b89347727490974290394f710
-
SHA1
9398009dcb984809a1d6ac4e357fe7db60c0469c
-
SHA256
28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2
-
SHA512
6304dd905183d69d6d2f7a259c555a668b24cba1b12e2a7e01a123b670a58027bbab2271404a7eb258bde126282888cb5c69c63dc9081eec2118ff424cdb79c3
-
SSDEEP
6144:xjDq4qUdcfAzMFwEO/RuhrTEr5txm/XpO5HrgBu59Fxfd4kx9ff5mBrC:1Tdc7LbrTEr5Xmw5HrgsvWSp4rC
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/800-138-0x0000000000400000-0x00000000004E2000-memory.dmp upx behavioral2/memory/800-140-0x0000000000400000-0x00000000004E2000-memory.dmp upx behavioral2/memory/800-142-0x0000000000400000-0x00000000004E2000-memory.dmp upx behavioral2/memory/800-143-0x0000000000400000-0x00000000004E2000-memory.dmp upx behavioral2/memory/800-144-0x0000000000400000-0x00000000004E2000-memory.dmp upx -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\Speech_OneCore\Common\tokens.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\icsxml\cmnicfg.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\Licenses\neutral\OEM\Professional\de-license.rtf 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\Recovery\ReAgent.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\Licenses\neutral\_Default\Professional\de-license.rtf 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\Licenses\neutral\_Default\Professional\license.rtf 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\wsmanconfig_schema.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\AppxProvisioning.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\lipeula.rtf 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\F12\Timeline.cpu.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\IME\IMEJP\APPLETS\IMJPCLST.XML 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\Licenses\neutral\Volume\Professional\license.rtf 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\license.rtf 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\NdfEventView.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\license.rtf 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\Volume\Professional\license.rtf 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.xls 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\wbem\xsl-mappings.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\Licenses\neutral\OEM\Professional\license.rtf 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\Speech_OneCore\Common\en-US\tokens_TTS_en-US.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\icsxml\potscfg.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\icsxml\pppcfg.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.ppt 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\Speech_OneCore\Common\en-US\tokens_TTS_en-US_david.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\icsxml\ipcfg.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\icsxml\osinfo.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\lpeula.rtf 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\tcpbidi.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\en-US\Licenses\_Default\Professional\license.rtf 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SysWOW64\Speech_OneCore\Common\en-US\Tokens_SR_en-US-N.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4252 set thread context of 800 4252 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe 81 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\am-ET\View3d\3DViewerProductDescription-universal.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_Safety_Objects.jpg 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ipsen.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ja-JP\View3d\3DViewerProductDescription-universal.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreRating\StoreRatingRules.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\bg-BG\View3d\3DViewerProductDescription-universal.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\tr-TR\View3d\3DViewerProductDescription-universal.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\Java\jdk1.8.0_66\javafx-src.zip 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\MissingAlbumArt.jpg 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ms-MY\View3d\3DViewerProductDescription-universal.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\es-MX\View3d\3DViewerProductDescription-universal.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hr-HR\View3d\3DViewerProductDescription-universal.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\music_offline_demo_page1.jpg 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\kk-KZ\View3d\3DViewerProductDescription-universal.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_Cliffhouse.jpg 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_Safety_NoObjects.jpg 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fa-IR\View3d\3DViewerProductDescription-universal.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ipssve.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\en-GB\View3d\3DViewerProductDescription-universal.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Archive.zip 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_01.jpg 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_05.jpg 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sv-SE\View3d\3DViewerProductDescription-universal.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-CN\View3d\3DViewerProductDescription-universal.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.19041.1_none_69cd9c22cfcf9358\Rules.System.Summary.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft.processmitigations.commands_31bf3856ad364e35_10.0.19041.662_none_2a8c125210169f86\r\Microsoft.ProcessMitigations.Commands.dll-Help.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-c..gshellapp.appxsetup_31bf3856ad364e35_10.0.19041.1_none_f5e2da3b41d3edfa\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.19041.423_none_0b0196a3d38fda4e\tokens_enCA.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.207_none_4054ef70f69f6ff9\wpr.config.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\appxmanifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..services-core-files_31bf3856ad364e35_10.0.19041.1_none_45dc4032c659ae7c\Rules.AD.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.19041.1_none_b977d9566df127e9\ConnectionManager.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-s..iencehost.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_52fbb1b86a870614\f\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-c..rymanager.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_f52dbf51d6536fa6\r\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..eexplorer.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_03d7aa1083b7645d\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.19041.423_none_204af7ff19532470\tokens_jaJP.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\speech\0416\tokens_ptBR.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_39a4d63e07cea862\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\ipsfin.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.19041.1_none_e2e6c013142b9760\tokens_jaJP.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.19041.746_none_afaafac6b02c16fa\insert.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-editions-professional_31bf3856ad364e35_10.0.19041.264_none_ba5e4a287945a683\ProfessionalEdition.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.19041.173_none_af877ec0b0472fde\ea-sym.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-deliveryoptimization_31bf3856ad364e35_10.0.19041.207_none_a87fa27025b2eaac\2213703c9c64cc61ba900531652e23c84728d2a2.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft.configci.commands_31bf3856ad364e35_10.0.19041.1081_none_21d54f6a980a590b\DefaultWindows_Enforced.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft.processmitigations.commands_31bf3856ad364e35_10.0.19041.662_none_2a8c125210169f86\Microsoft.ProcessMitigations.Commands.dll-Help.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-s..iencehost.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_411a61445fd08261\f\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..ment-enterprisecsps_31bf3856ad364e35_10.0.19041.153_none_2a1e6a613d7771a3\CertificateStore_DDF.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.19041.746_none_afaafac6b02c16fa\auxpad.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-c..iser-inboxdatafiles_31bf3856ad364e35_10.0.19041.1202_none_e636843d96260ccd\Appraiser_TelemetryRunList.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\tokens_enIN.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-c..urepicker.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_2719bdeef32ae98e\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.19041.746_none_afaafac6b02c16fa\osknumpadbase.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-taskscheduler-service_31bf3856ad364e35_10.0.19041.264_none_0ce2bf73f5e3d0ee\D61D61C8-D73A-4EEE-8CDD-F6F9786B7124.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..services-core-files_31bf3856ad364e35_10.0.19041.1_none_45dc4032c659ae7c\Active Directory Diagnostics.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.19041.1288_none_23aa03725ec9354a\14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_netfx4-groupedproviders_xml_b03f5f7f11d50a3a_4.0.15805.0_none_13ff5789a30eb0e9\GroupedProviders.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.19041.423_none_0b0196a3d38fda4e\tokens_enUS.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.19041.746_none_afaafac6b02c16fa\base_heb.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\tokens_enUS.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\DefaultSettings.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.19041.1_none_e2e6c013142b9760\tokens_itIT.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.746_none_4028b8f4f6c0b829\wpr.config.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.19041.1_none_b977d9566df127e9\MediaReceiverRegistrar.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.19041.207_none_11794cc79cc85d1d\r\ceb497ee0184aaa4681d2fb2ef242a5b8551eea8.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_757b1fb62148c452\r\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\ipsfra.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.19041.1_none_e2e6c013142b9760\tokens_frFR.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.19041.746_none_afaafac6b02c16fa\keypadbase.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.19041.1_none_f830216e59eee182\tokens_ptBR.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.19041.423_none_204af7ff19532470\tokens_frFR.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\BingConfiguration\BingConfiguration_fr-FR.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppxBlockMap.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-s..iencehost.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_411a61445fd08261\f\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..trolpanel.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_d23715c9ea6f2f2c\f\appxmanifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-c..urepicker.appxsetup_31bf3856ad364e35_10.0.19041.1_none_683314e4dd640401\AppxManifest.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-compat-appraiser_31bf3856ad364e35_10.0.19041.1266_none_0615c459620affef\Win32CompatibilityAppraiser_DDF.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-editions-professional_31bf3856ad364e35_10.0.19041.264_none_ba5e4a287945a683\ProfessionalCountrySpecificEdition.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\HvsiMachinePolicies_ContainerRealtime.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.19041.173_none_af877ec0b0472fde\ja-jp-sym.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\speech\0416\tokens_ptBR.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\speech\0c0c\tokens_frCA.xml 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4252 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4252 wrote to memory of 800 4252 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe 81 PID 4252 wrote to memory of 800 4252 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe 81 PID 4252 wrote to memory of 800 4252 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe 81 PID 4252 wrote to memory of 800 4252 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe 81 PID 4252 wrote to memory of 800 4252 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe 81 PID 4252 wrote to memory of 800 4252 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe 81 PID 4252 wrote to memory of 800 4252 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe 81 PID 4252 wrote to memory of 800 4252 28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe"C:\Users\Admin\AppData\Local\Temp\28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe"C:\Users\Admin\AppData\Local\Temp\28f744eec8b4d0ed71d233c470641072aa58b111f4440ef38584e09d8a90c0b2.exe"2⤵
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:800
-