Analysis
-
max time kernel
119s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-01-2023 21:02
Behavioral task
behavioral1
Sample
841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe
-
Size
7KB
-
MD5
a29fc50d11f97997ce0c38ecd238355e
-
SHA1
52e21efa1477c1bd269eddd91ae0a13d3e47e835
-
SHA256
841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83
-
SHA512
a10afe7db8b8773f3fb8d728abb0b748a6dd6b41ef045f66eda00eaf09ea9603147c5477c3a56bf65add3716001a493880db50e93522d305e61db198284fde55
-
SSDEEP
192:nzdrr1FG1WDCgmjPZEysGsXpFHL99oMUA:nprr1gkDCgS+dGWpFHL9KMB
Score
10/10
Malware Config
Signatures
-
Detected Xorist Ransomware 2 IoCs
resource yara_rule behavioral2/memory/4628-133-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral2/memory/4628-134-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe -
resource yara_rule behavioral2/memory/4628-132-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/4628-133-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/4628-134-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5vPl3Y4523Ek90l.exe" 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_fffc54d66d592d52\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcom1.inf_amd64_cfd501781ae941c0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmzyp.inf_amd64_19eb30e94285f2a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\ykinx64.inf_amd64_0bbd8466b526ef26\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\winrm\0409\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\bda.inf_amd64_d32fe6b1c2b7b2a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\c_floppydisk.inf_amd64_bc7bd9dca28933ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmeric2.inf_amd64_facbddcbb097c790\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmotou.inf_amd64_8370fa408706074c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_ede00b448bfe8099\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.ppt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_9a5b429abc465278\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\wpdmtphw.inf_amd64_1aae998f86058cec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\battery.inf_amd64_a239bc596073092a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\c_mtd.inf_amd64_2f8cc39571965376\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnis1u.inf_amd64_64035dd8a7571ba7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_ec11d0ad3c5b262a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\scrawpdo.inf_amd64_466615aad3be8e26\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\c_cashdrawer.inf_amd64_a648ee708660440c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_glk.inf_amd64_dad1e0a2b185e32b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmct.inf_amd64_0f3268711a5b2622\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmpin.inf_amd64_be5d923b5e701b62\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\adp80xx.inf_amd64_efb36fdc260e8bc8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj6.inf_amd64_5a503c811e650e70\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmusrf.inf_amd64_ddaa09c6103bc6ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\smrdisk.inf_amd64_f945aad6094163f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\c_memory.inf_amd64_6fa9664593233d6e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\slmgr\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fsinfrastructure.inf_amd64_1ef682cfd6fc7d1c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\c_tapedrive.inf_amd64_a3a36e8f2c921ed7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\hal.inf_amd64_fd0ae947345ac7bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\sl-SI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\c_smrdisk.inf_amd64_bbef253cecafbb1a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\ks.inf_amd64_9fac168e1cbea90c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmusrg.inf_amd64_bb7c44c7bb3664d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\XPSViewer\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgatew.inf_amd64_7e6c377859cfcb7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\Speech_OneCore\Engines\TTS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\c_apo.inf_amd64_a261b6effa32e5a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\c_mcx.inf_amd64_fcbcc3807cbf63ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsun2.inf_amd64_de323a35134348a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\vca.inf_amd64_6bbc643de0df118d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\F12\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\c_receiptprinter.inf_amd64_7952e4baaee88d58\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\netpgm.inf_amd64_e099e4a7092b374c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\7.jpg 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-40_altform-colorize.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\wiggle350.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_contrast-white.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-40_altform-lightunplated.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSmallTile.scale-125.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\SmallLogo.scale-100_contrast-black.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-125_contrast-white.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail.scale-200.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sk-sk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-30_altform-unplated.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-24.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-200_contrast-black.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\Views\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-20.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xee27.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\CortanaApp.ViewElements\Assets\[email protected] 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-256_altform-lightunplated.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsWideTile.contrast-black_scale-200.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageLargeTile.scale-200_contrast-black.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-96_altform-unplated.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Windows NT\Accessories\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\be-BY\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-60_contrast-high.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-72x72-precomposed.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageMedTile.scale-100.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-256.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-64.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-24_altform-unplated.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf-2x.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\MedTile.scale-200_contrast-black.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\review_poster.jpg 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-125.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.scale-200_contrast-white.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupSmallTile.scale-200.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageMedTile.scale-200.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-64.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\SmallTile.scale-200.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-cn\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-64_altform-unplated_contrast-white.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorSplashScreen.contrast-white_scale-125.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-125_contrast-high.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-rmcast_31bf3856ad364e35_10.0.19041.1_none_14c384075ba947e6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\repost.htm 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_hyperv-datastore.resources_31bf3856ad364e35_10.0.19041.1_it-it_13692c1a3f13319c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-foundatio..ostics-errordetails_31bf3856ad364e35_10.0.19041.746_none_e71759f8523aa8f2\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nager-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_34bb15d0aa3fc3a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.19041.1_none_6da8f779b049952c\09 - Mobility Center.lnk 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shwebsvc.resources_31bf3856ad364e35_10.0.19041.1_it-it_743a07620ff0f8ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-l..st-abovelockapphost_31bf3856ad364e35_10.0.19041.844_none_5c96fadead19a0b7\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\i_snapshot.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_oposdrv.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4b53f9c04daf819f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_system.management.i..mentation.resources_b77a5c561934e089_4.0.15805.0_de-de_dffdc95c7c5ae371\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..t-resources-mrmcore_31bf3856ad364e35_10.0.19041.264_none_c9604b1dc0c642f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..pellcheck.resources_31bf3856ad364e35_10.0.19041.1_de-de_359acd1afb50279a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_4d42c87de3fe145b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.19041.746_none_38c6194376a6b88c\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\PLA\Reports\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\DefaultSystemNotification.contrast-white_scale-200.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_hid-user.resources_31bf3856ad364e35_10.0.19041.1_it-it_a83e66a954bae1fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-holoshellruntime_31bf3856ad364e35_10.0.19041.264_none_8c0ff17d5f0dd1ac\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_reachframework.resources_31bf3856ad364e35_4.0.15805.0_ja-jp_9fc1eb945da9f0bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.1202_none_024525bdc81df50d\n\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-maintenanceui_31bf3856ad364e35_10.0.19041.1_none_aade233709aa6d12\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msieftp.resources_31bf3856ad364e35_10.0.19041.1_it-it_f70fe2f5ca350fb9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.19041.906_none_066336a1b904a848\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Ratings\RatingStars42.contrast-black_scale-200.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\msil_system_b77a5c561934e089_10.0.19041.1_none_9b78698aecf8304b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_e745f3d5634edc40\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ercomtool.resources_31bf3856ad364e35_10.0.19041.1_en-us_0185ace639b292b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_image.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_b89b53ec97b3c06e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-consolelogon-library_31bf3856ad364e35_10.0.19041.264_none_6336533b85d8e590\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..n-comrepl.resources_31bf3856ad364e35_10.0.19041.1_de-de_91c26504bf2cf2ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\wow64_windows-staterepository_31bf3856ad364e35_10.0.19041.264_none_e4e6a1265c59e73b\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.ServiceMoniker40\v4.0_4.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\previewTabClose.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-client_31bf3856ad364e35_10.0.19041.546_none_749638bb0a6efc61\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\msil_microsoft.appv.appvclientwmi.resources_31bf3856ad364e35_10.0.19041.1_de-de_a212663b2f54191b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..alproviders-library_31bf3856ad364e35_10.0.19041.1202_none_0b2fd75745b4fb23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..p-service.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d9aa39a3590c9168\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_genericusbfn.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_e57e99988254e91e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_dual_c_fscontentscreener.inf_31bf3856ad364e35_10.0.19041.1_none_ed20e9a0b1f8a690\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autoplay.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_f9621223f331f655\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..iamanager.resources_31bf3856ad364e35_10.0.19041.1_de-de_1b4bf0c706712cdc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00030408_31bf3856ad364e35_10.0.19041.1_none_89a8b02bd949b761\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw.resources_31bf3856ad364e35_10.0.19041.1_de-de_d1e1553ecc6e465c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.scale-150.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..agnostics.resources_31bf3856ad364e35_10.0.19041.1_en-us_b462bf186fb84518\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_netwtw02.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_5d563b8f3a12fd32\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..it-snapin.resources_31bf3856ad364e35_10.0.19041.1_es-es_6af0c15fa43a381b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\x86_caspol_b03f5f7f11d50a3a_10.0.19041.1_none_2cbf497a80df4629\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-dsdbutil.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_24c52eed615d0b3c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..onenumberformatting_31bf3856ad364e35_10.0.19041.1_none_3117a5cb798a5536\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_dual_ipmidrv.inf_31bf3856ad364e35_10.0.19041.1052_none_bef8a6b7672fbe73\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..ocess-mui.resources_31bf3856ad364e35_10.0.19041.1_en-us_12542eba550e43cf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-spp-wga_31bf3856ad364e35_10.0.19041.1_none_bf9741d87713bb8a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tbs_31bf3856ad364e35_10.0.19041.1_none_aefd8ccb4c12969d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..uetooth-dafprovider_31bf3856ad364e35_10.0.19041.746_none_fdc3acdd83fbafd5\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSplashScreen.scale-200_contrast-white.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare50x50.scale-100_contrast-black.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-spp-clientext_31bf3856ad364e35_10.0.19041.1_none_8d0cadaa84dd3db3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Ratings\RatingStars38.scale-200.png 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MNTKGDXODBUCVOD\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5vPl3Y4523Ek90l.exe,0" 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MNTKGDXODBUCVOD\shell\open\command 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MNTKGDXODBUCVOD\ = "CRYPTED!" 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tg\ = "MNTKGDXODBUCVOD" 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MNTKGDXODBUCVOD 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MNTKGDXODBUCVOD\DefaultIcon 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MNTKGDXODBUCVOD\shell 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MNTKGDXODBUCVOD\shell\open 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MNTKGDXODBUCVOD\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5vPl3Y4523Ek90l.exe" 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tg 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:4628