Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2023, 20:54
Static task
static1
Behavioral task
behavioral1
Sample
933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe
Resource
win7-20230220-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe
-
Size
383KB
-
MD5
169252f7614bf6c6b43e8532e6623d57
-
SHA1
30e2c45ff71eb78c7d1a1032b3b2c46c9d87e24e
-
SHA256
933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8
-
SHA512
d116c247d1e3b7f7025dc01e100043a62b635dbe04f4ae0b3f94ba17936ba859b7edb321ac54fa26a1016ee97555a43fc536290b334b84fd0c2b124c5958b1ab
-
SSDEEP
6144:8RzMgpY8bXFHW1FbwwEHidUoagoW2C9cuqBGI4Zq6mYlGVYJNfNQFoQGt485VYg+:qDRbXFHW1+K2UWBGIymYeYJheFOvd+
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pr = "C:\\Program Files (x86)\\933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe" 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\Volume\Professional\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\fr-FR\lipeula.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\APPLETS\IMJPCLST.XML 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\Licenses\neutral\_Default\Professional\de-license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_8bc1bda6cf47380c\MXDW-pipelineconfig.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\en-US\lpeula.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\F12\Timeline.cpu.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\wsmanconfig_schema.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\icsxml\potscfg.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\icsxml\pppcfg.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\NdfEventView.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\Volume\Professional\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_add71423ba73e797\Amd64\MSxpsPS-pipelineconfig.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\Amd64\MSPWGR-pipelineconfig.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\icsxml\ipcfg.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_a7412a554c9bc1fd\MPDW-PDC.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms012.inf_amd64_707d3849370b9d23\Amd64\MSIPP-pipelineconfig.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\es-ES\lipeula.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\Speech_OneCore\Common\en-US\tokens_TTS_en-US.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms008.inf_amd64_69b5e0c918eab9a6\Amd64\unishare3d-pipelineconfig.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\es-ES\lpeula.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Professional\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\icsxml\cmnicfg.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\icsxml\osinfo.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\lcptr.tbl 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\Licenses\neutral\_Default\Professional\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\tcpbidi.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms014.inf_amd64_faec3fc366f8e1fa\Amd64\MSMPS-pipelineconfig.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\OEM\Professional\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\Licenses\neutral\OEM\Professional\de-license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.ppt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ntprint4.inf_amd64_0958c7cad3cd6075\Amd64\V3HostingFilter-pipelineconfig.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_f83138380f5fb6ab\Amd64\MSAppMon-pipelineconfig.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\Recovery\ReAgent.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\Amd64\MSECP.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\Professional\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\it-IT\lipeula.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.xls 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\Speech_OneCore\Common\en-US\Tokens_SR_en-US-N.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendToOneNote-pipelineconfig.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_a7412a554c9bc1fd\MPDW-pipelineconfig.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_a7412a554c9bc1fd\MPDW_devmode_map.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\fr-FR\lpeula.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\Professional\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\Amd64\MSPassthrough-pipelineconfig.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\Amd64\MSPWGR.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\Amd64\MSXPS2.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\Amd64\MSECP-pipelineconfig.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\Professional\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\it-IT\lpeula.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\lcphrase.tbl 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\AppxProvisioning.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\de-DE\lpeula.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_f83138380f5fb6ab\Amd64\MSAppMon.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\Volume\Professional\license.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\Speech_OneCore\Common\en-US\tokens_TTS_en-US_david.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SysWOW64\WindowsCodecsRaw.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Microsoft Office\Office16\SLERROR.XML 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\3.jpg 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppxManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-options.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN096.XML 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\canvas_light.jpg 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireMedTile.scale-100.jpg 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-api.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fr-FR\View3d\3DViewerProductDescription-universal.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fa-IR\View3d\3DViewerProductDescription-universal.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\AppxManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\AppxManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL001.XML 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lo-LA\View3d\3DViewerProductDescription-universal.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireSmallTile.scale-125.jpg 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-swing-tabcontrol.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\31.jpg 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\AppxManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\BuildInfo.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PG_INDEX.XML 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\THIRDPARTYLICENSEREADME.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_06.jpg 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-us\outlook_whatsnew.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\MicrosoftWordpad.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\PLA\Reports\de-DE\Report.System.Memory.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..ep-chxapp.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_7d8eee60f8081103\AppxBlockMap.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-h..indetails.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_571aea43e74beb86\OOBE_HELP_Opt_in_Details.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\UKRAINE.TXT 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..esolverux.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_30675b33c3afc2a2\r\AppxManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-audiodiagnostic_31bf3856ad364e35_10.0.19041.1_none_767880898f16fada\AudioRecordingDiagnostic.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\PLA\Rules\en-US\Rules.System.Diagnostics.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\13.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-UserProxyFull.LDF 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-h..statement.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14f2c7cd5a26582c\vofflps.rtf 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\MicrosoftOffice2016BackupWin64.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..urepicker.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_2719bdeef32ae98e\AppxManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-ADAM-Upgrade-2.LDF 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\BingConfiguration\BingConfiguration_es-MX.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..ep-chxapp.appxsetup_31bf3856ad364e35_10.0.19041.1_none_bea84556e2412b76\AppxBlockMap.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..esolverux.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_30675b33c3afc2a2\AppxBlockMap.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-dot3svc.resources_31bf3856ad364e35_10.0.19041.1_it-it_49b480c7a139c853\Rules.System.NetDiagFramework.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_39a4d63e07cea862\r\AppxManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ore-files.resources_31bf3856ad364e35_10.0.19041.1_it-it_0bf4c007e9677824\Rules.AD.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxsetup_31bf3856ad364e35_10.0.19041.1_none_ae653a53c0cafb8a\AppxManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-font-fms_31bf3856ad364e35_10.0.19041.1_none_fdc3c32153adba41\fms_metadata.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\PLA\Rules\es-ES\Rules.System.Configuration.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\PLA\Rules\it-IT\Rules.System.Wired.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\BingConfiguration\BingConfiguration_pt-BR.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\Media\Focus1_48000Hz.raw 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..eexplorer.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_03d7aa1083b7645d\r\AppxManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\PLA\Reports\ja-JP\Report.System.NetDiagFramework.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\diagnostics\index\NetworkDiagnostics_2_FileShare.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\PLA\Reports\de-DE\Report.System.Wireless.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\PLA\Reports\es-ES\Report.System.Network.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\tokens_deDE.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-dot3svc.resources_31bf3856ad364e35_10.0.19041.1_it-it_49b480c7a139c853\Report.System.Wired.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\PLA\Reports\es-ES\Report.System.NetDiagFramework.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\PLA\Rules\it-IT\Rules.System.NetDiagFramework.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\appxmanifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\PLA\Reports\fr-FR\Report.System.Configuration.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\PLA\Rules\fr-FR\Rules.System.Wired.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\7.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..gshellapp.appxsetup_31bf3856ad364e35_10.0.19041.1_none_f5e2da3b41d3edfa\AppxManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ore-files.resources_31bf3856ad364e35_10.0.19041.1_en-us_7f49f6de1f3c8a9f\Rules.AD.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\PLA\Reports\es-ES\Report.System.Diagnostics.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\AppCacheMetadata.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..modernappmanagement_31bf3856ad364e35_10.0.19041.1_none_650d2aacd099e9c0\EnterpriseModernAppManagementDDF.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..ep-chxapp.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_7d8eee60f8081103\f\appxmanifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..modernappmanagement_31bf3856ad364e35_10.0.19041.746_none_8d1567f5900ba80a\EnterpriseModernAppManagementDDF.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..eexplorer.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_03d7aa1083b7645d\AppxBlockMap.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-ParentDistname.LDF 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\AppxBlockMap.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\Vss\Writers\System\0bada1de-01a9-4625-8278-69e735f39dd2.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\Web\Wallpaper\Theme1\img13.jpg 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..eexplorer.appxsetup_31bf3856ad364e35_10.0.19041.1_none_44f101066df07ed0\AppxManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\HvsiMachinePolicies_ContainerRealtime.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\PLA\Reports\fr-FR\Report.System.Diagnostics.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..esolverux.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_30675b33c3afc2a2\AppxManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..eexplorer.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_03d7aa1083b7645d\f\AppxManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\2.txt 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\MicrosoftLync2013Win64.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\NetFx40_IIS_schema_update.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\schemas\CodeIntegrity\ExamplePolicies\DenyAllAudit.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\AppxManifest.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.19041.746_none_251e769058968366\behavior.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe File opened for modification C:\Windows\diagnostics\index\BITSDiagnostic.xml 933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe"C:\Users\Admin\AppData\Local\Temp\933d74ff8619fec658ef6c115cc0f0095cef36148922ccddbd7900cbf12afef8.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2184
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml
Filesize3.4MB
MD56e80251e501752bab07c0df285f21da1
SHA1eb19426399e33c1883dd51c321fb3e8b799c961b
SHA2562322338ef60feaf809943440312d3d5323c2006c52a1945a158828070744825e
SHA512c7d7d827f46fe2c87fef71161b7597fb45781cb9d519f9225c03340e10f742e44658c7de1d1e71105f5b1dcbcab25b2290378e3fa3a11423e2ee205cc1e3172c