Overview
overview
10Static
static
1007ba533a69...53.exe
windows7-x64
107ba533a69...53.exe
windows10-2004-x64
10e971ff0e7...8d.exe
windows7-x64
80e971ff0e7...8d.exe
windows10-2004-x64
8111fb06de8...8b.exe
windows7-x64
9111fb06de8...8b.exe
windows10-2004-x64
92de3cea3eb...a8.exe
windows7-x64
12de3cea3eb...a8.exe
windows10-2004-x64
1327a2a4916...ca.exe
windows7-x64
8327a2a4916...ca.exe
windows10-2004-x64
836c10a3e1f...d9.exe
windows7-x64
136c10a3e1f...d9.exe
windows10-2004-x64
167bf260c3e...10.exe
windows7-x64
867bf260c3e...10.exe
windows10-2004-x64
870ec1874cf...ac.exe
windows7-x64
170ec1874cf...ac.exe
windows10-2004-x64
1817f5b0fcc...99.exe
windows7-x64
7817f5b0fcc...99.exe
windows10-2004-x64
7875a6185aa...f0.exe
windows7-x64
1875a6185aa...f0.exe
windows10-2004-x64
1887d386d2e...c6.exe
windows7-x64
1887d386d2e...c6.exe
windows10-2004-x64
1902afe35c6...16.exe
windows7-x64
10902afe35c6...16.exe
windows10-2004-x64
1097b6e51df2...0a.exe
windows7-x64
797b6e51df2...0a.exe
windows10-2004-x64
7a4704be3a7...72.exe
windows7-x64
1a4704be3a7...72.exe
windows10-2004-x64
1b21f34ecfa...73.exe
windows7-x64
9b21f34ecfa...73.exe
windows10-2004-x64
9b75b3ff656...52.exe
windows7-x64
8b75b3ff656...52.exe
windows10-2004-x64
8Analysis
- max time kernel
150s - max time network
121s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
01/01/2024, 14:50
Behavioral task
behavioral1
Sample
07ba533a694e1733f8ef1c18ac191867382f4ca7a51244cda6ef5ec119fbfe53.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
07ba533a694e1733f8ef1c18ac191867382f4ca7a51244cda6ef5ec119fbfe53.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral7
Sample
2de3cea3eb6eedbec7436f426a5259d4f65374b326823feee17175407f08e7a8.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
2de3cea3eb6eedbec7436f426a5259d4f65374b326823feee17175407f08e7a8.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
327a2a49164bc38c88a2d030ece9a7487b82e8a34d3f398e071654e5fcc4d7ca.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
327a2a49164bc38c88a2d030ece9a7487b82e8a34d3f398e071654e5fcc4d7ca.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
36c10a3e1f93c4d50fb617ab7cd629bebea7ca5f827239ba98156ff88d27f7d9.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
36c10a3e1f93c4d50fb617ab7cd629bebea7ca5f827239ba98156ff88d27f7d9.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
70ec1874cf1304960c0b1b828216a22704caaff23ea514c1067efe9ce4b69aac.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
70ec1874cf1304960c0b1b828216a22704caaff23ea514c1067efe9ce4b69aac.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
817f5b0fcccda6756c485e463b3f0ea43bb894f866ce5cac9f7d1f065e3e1999.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
817f5b0fcccda6756c485e463b3f0ea43bb894f866ce5cac9f7d1f065e3e1999.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral19
Sample
875a6185aa50896f96a40c75005c849b320ef27f7332e7a2c0c2c1d3d55faff0.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
875a6185aa50896f96a40c75005c849b320ef27f7332e7a2c0c2c1d3d55faff0.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
887d386d2ea9af0c079f4010311069045df5c51d658921b2c9de81c4378b4bc6.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
887d386d2ea9af0c079f4010311069045df5c51d658921b2c9de81c4378b4bc6.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe
Resource
win7-20231215-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral24
Sample
902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral25
Sample
97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral30
Sample
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral31
Sample
b75b3ff65632b65d1d641075bd2f5ed0ede93da3a35d7f50068b9371ee5c4552.exe
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral32
Sample
b75b3ff65632b65d1d641075bd2f5ed0ede93da3a35d7f50068b9371ee5c4552.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
- Size 662KB
- Sample240101-r7thvscfhp
- SHA256 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b
- MD5 b6c70f89f19670923f3f490ed5331395
- SHA1 24c9df54d779be27508203666dc48a3fdabb0b87
- SHA512 8a49a73c4086be3ae657452816070d7bf79dc653a9a7c783262348788ee80584c4456e3056f1427f4f1b8433de54437b996bfbede100430b2f7168c130511b0b
- SSDEEP 12288:IG86nitqrIT6Eqk56i258EJsUQUUJ9LBHd2Uo:57itqr3e6d18J9LBHd2n
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (2700) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Documents\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Recorded TV\Sample Media\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BP3UABCB\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Contacts\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Media\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Downloads\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Music\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Videos\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Libraries\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\FW0P2MZH\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Web\Wallpaper\Landscapes\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Pictures\Sample Pictures\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Downloaded Program Files\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Web\Wallpaper\Nature\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Music\Sample Music\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Globalization\MCT\MCT-US\Wallpaper\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Links\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\27PKR52P\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Recorded TV\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\0U93YK0N\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Pictures\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Videos\Sample Videos\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Documents\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Desktop\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Downloads\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe - Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\12520437.cpx 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\SysWOW64\12520850.cpx 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\SysWOW64\aaclient.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\SysWOW64\aclui.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\SysWOW64\acppage.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\SysWOW64\ActionCenter.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\SysWOW64\regedit.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\SysWOW64\ACCTRES.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\SysWOW64\acledit.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\SysWOW64\ActionCenterCPL.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\SysWOW64\activeds.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\SysWOW64\accessibilitycpl.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14532_.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\AFTRNOON.ELM 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Defender\en-US\MpAsDesc.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Media Player\Skins\Revert.wmz 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21306_.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\mip.exe.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\THMBNAIL.PNG 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\settings.css 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OrielMergeFax.Dotx 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\icon.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\PREVIEW.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\cpu.css 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\System\msadc\es-ES\msadcor.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18198_.WMF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0214098.WAV 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-4.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_es.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1CACH.LEX 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\JPEGIM32.FLT 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\System\msadc\ja-JP\msadcfr.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Media Player\wmpenc.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15018_.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\clock.js 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialReport.dotx 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\System\msadc\ja-JP\msadcor.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FPERSON.DLL 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10255_.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.CSD 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\slideShow.js 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15301_.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\THEMES.INF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUDIOSEARCHMAIN.DLL 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15277_.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.jpg 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_h.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Media Player\WMPNSSUI.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\THMBNAIL.PNG 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\RSSFeeds.css 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\System\ado\msjro.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\8.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0212219.WMF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\System\msadc\msdaprst.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\22.png 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\VSTARemotingServer.tlb 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Civic.thmx 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\settings.js 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\System\msadc\msdaremr.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\pdfshell.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\Synchronization.rll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FiveRules.potx 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\System\msadc\en-US\msaddsr.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\WPGIMP32.FLT 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14829_.GIF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0199727.WMF 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Median.thmx 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\msdaorar.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\Microsoft.GroupPolicy.AdmTmplEditor.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\diagnostics\system\Printer\RS_CancelAllJobs.ps1 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\ehshell\d1dc67c666bc15291be843bd67cd2a2e\ehshell.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Boot\EFI\en-US\bootmgfw.efi.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.AddIn\c4f5b7665e854d2459cb1340bc88fde9\System.AddIn.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\rescache\ResCache.mni 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_ja_b03f5f7f11d50a3a\Microsoft.Build.Tasks.resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Policy.1.7.Microsoft.Ink.config 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\EventViewer\6.1.0.0__31bf3856ad364e35\EventViewer.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\c899de3549784161aa66610d5735e4f0\ehExtHost32.ni.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\__AssemblyInfo__.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\explorer.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\diagnostics\system\Device\CL_Utility.ps1 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Globalization\Sorting\SortServer2003Compat.nls 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\IME\imekr8\dicts\imkrhjd.lex 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\IME\imekr8\help\imkr.chm 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Messaging\ee9a323861b378713f17421b0d98adb5\System.Messaging.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\fr-FR\bfsvc.exe.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Activities\bf808b9c0c44745fc6bf261c44003c7a\System.Activities.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\diagnostics\system\DeviceCenter\de-DE\CL_LocalizationData.psd1 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Vf4833439#\161558be6141676dd6679dfffabde9c7\Microsoft.VisualBasic.Activities.Compiler.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\ehiUPnP\6.1.0.0__31bf3856ad364e35\ehiUPnP.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio49d6fefe#\f52bfe40c54917622ed3abb98db8f90a\PresentationFramework-SystemXml.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net\c252762f9efbc0ad25f01a475b7d00ad\System.Net.ni.dll.aux 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Boot\DVD\PCAT\BCD 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.iTV.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\PLA\Reports\Report.System.Wireless.xml 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\diagnostics\system\PCW\de-DE\CL_LocalizationData.psd1 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Boot\PCAT\it-IT\bootmgr.exe.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\en-US\twain_32.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Build\ca807340cc583efabfc0f3ded2609280\Microsoft.Build.ni.dll.aux 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Boot\EFI\ja-JP\memtest.efi.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\75913bbaf1bee617a94dcd6b5df12a5d\System.Core.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\ehiExtens\6.1.0.0__31bf3856ad364e35\ehiExtens.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Boot\PCAT\ko-KR\bootmgr.exe.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Data.Entity.#\8f1dcb9771b151969c5afdae76376d5c\System.Data.Entity.Design.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\diagnostics\system\WindowsUpdate\TS_Connectivity.ps1 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Boot\EFI\zh-CN\bootmgfw.efi.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\es-ES\explorer.exe.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\diagnostics\system\Search\ja-JP\CL_LocalizationData.psd1 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\HelpPane.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\2ad23de8284d4594aa658dfb5e667d97\PresentationCore.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\diagnostics\system\Device\RS_EnableDevice.ps1 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\IME\IMETC10\DICTS\IMTCLS.IMD 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Serv14259fd9#\b6a1466f4c910dd8d83b4592bef36aff\System.ServiceModel.Activities.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\servicing\wrpintapi.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\14afe54e24cf09fe6c371fc47cfabf0e\Microsoft.Build.Engine.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Boot\PCAT\fi-FI\bootmgr.exe.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\inf\1394.inf 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Speech\Engines\Lexicon\de-DE\grph1031.lxa 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\907f5045e26c39e1ae48024201b6334d\System.Data.OracleClient.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Globalization\MCT\MCT-US\Theme\US.theme 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Te49ad7d9#\c73da2d72e0bbeaf6538615dba2d7143\Microsoft.Transactions.Bridge.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\AuditPolicyGPManage#\ce8c100b866ac8facc1902286aede990\AuditPolicyGPManagedStubs.Interop.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\PresentationUI\93309b55a9caa04c2f4fe06c13438631\PresentationUI.ni.dll.aux 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\ehiUserXp\6.1.0.0__31bf3856ad364e35\ehiUserXp.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\IME\fr-FR\SpTip.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Infopath.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\schemas\EAPMethods\mspeapconnectionpropertiesv2.xsd 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\IME\en-US\SpTip.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\IME\IMESC5\DICTS\PINTLGAP.IMD 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\748de10ea72fad908022d9507c7304fc\System.Data.Linq.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Boot\EFI\tr-TR\bootmgfw.efi.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe"C:\Users\Admin\AppData\Local\Temp\111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe"1⤵
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2868