Overview
overview
10Static
static
1007ba533a69...53.exe
windows7-x64
107ba533a69...53.exe
windows10-2004-x64
10e971ff0e7...8d.exe
windows7-x64
80e971ff0e7...8d.exe
windows10-2004-x64
8111fb06de8...8b.exe
windows7-x64
9111fb06de8...8b.exe
windows10-2004-x64
92de3cea3eb...a8.exe
windows7-x64
12de3cea3eb...a8.exe
windows10-2004-x64
1327a2a4916...ca.exe
windows7-x64
8327a2a4916...ca.exe
windows10-2004-x64
836c10a3e1f...d9.exe
windows7-x64
136c10a3e1f...d9.exe
windows10-2004-x64
167bf260c3e...10.exe
windows7-x64
867bf260c3e...10.exe
windows10-2004-x64
870ec1874cf...ac.exe
windows7-x64
170ec1874cf...ac.exe
windows10-2004-x64
1817f5b0fcc...99.exe
windows7-x64
7817f5b0fcc...99.exe
windows10-2004-x64
7875a6185aa...f0.exe
windows7-x64
1875a6185aa...f0.exe
windows10-2004-x64
1887d386d2e...c6.exe
windows7-x64
1887d386d2e...c6.exe
windows10-2004-x64
1902afe35c6...16.exe
windows7-x64
10902afe35c6...16.exe
windows10-2004-x64
1097b6e51df2...0a.exe
windows7-x64
797b6e51df2...0a.exe
windows10-2004-x64
7a4704be3a7...72.exe
windows7-x64
1a4704be3a7...72.exe
windows10-2004-x64
1b21f34ecfa...73.exe
windows7-x64
9b21f34ecfa...73.exe
windows10-2004-x64
9b75b3ff656...52.exe
windows7-x64
8b75b3ff656...52.exe
windows10-2004-x64
8Analysis
- max time kernel
147s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
01/01/2024, 14:50
Behavioral task
behavioral1
Sample
07ba533a694e1733f8ef1c18ac191867382f4ca7a51244cda6ef5ec119fbfe53.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
07ba533a694e1733f8ef1c18ac191867382f4ca7a51244cda6ef5ec119fbfe53.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral7
Sample
2de3cea3eb6eedbec7436f426a5259d4f65374b326823feee17175407f08e7a8.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
2de3cea3eb6eedbec7436f426a5259d4f65374b326823feee17175407f08e7a8.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
327a2a49164bc38c88a2d030ece9a7487b82e8a34d3f398e071654e5fcc4d7ca.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
327a2a49164bc38c88a2d030ece9a7487b82e8a34d3f398e071654e5fcc4d7ca.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
36c10a3e1f93c4d50fb617ab7cd629bebea7ca5f827239ba98156ff88d27f7d9.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
36c10a3e1f93c4d50fb617ab7cd629bebea7ca5f827239ba98156ff88d27f7d9.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
70ec1874cf1304960c0b1b828216a22704caaff23ea514c1067efe9ce4b69aac.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
70ec1874cf1304960c0b1b828216a22704caaff23ea514c1067efe9ce4b69aac.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
817f5b0fcccda6756c485e463b3f0ea43bb894f866ce5cac9f7d1f065e3e1999.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
817f5b0fcccda6756c485e463b3f0ea43bb894f866ce5cac9f7d1f065e3e1999.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral19
Sample
875a6185aa50896f96a40c75005c849b320ef27f7332e7a2c0c2c1d3d55faff0.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
875a6185aa50896f96a40c75005c849b320ef27f7332e7a2c0c2c1d3d55faff0.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
887d386d2ea9af0c079f4010311069045df5c51d658921b2c9de81c4378b4bc6.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
887d386d2ea9af0c079f4010311069045df5c51d658921b2c9de81c4378b4bc6.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe
Resource
win7-20231215-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral24
Sample
902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral25
Sample
97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral30
Sample
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral31
Sample
b75b3ff65632b65d1d641075bd2f5ed0ede93da3a35d7f50068b9371ee5c4552.exe
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral32
Sample
b75b3ff65632b65d1d641075bd2f5ed0ede93da3a35d7f50068b9371ee5c4552.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
- Size 662KB
- Sample240101-r7thvscfhp
- SHA256 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b
- MD5 b6c70f89f19670923f3f490ed5331395
- SHA1 24c9df54d779be27508203666dc48a3fdabb0b87
- SHA512 8a49a73c4086be3ae657452816070d7bf79dc653a9a7c783262348788ee80584c4456e3056f1427f4f1b8433de54437b996bfbede100430b2f7168c130511b0b
- SSDEEP 12288:IG86nitqrIT6Eqk56i258EJsUQUUJ9LBHd2Uo:57itqr3e6d18J9LBHd2n
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (946) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 61 IoCs
description ioc Process File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\3D Objects\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Saved Games\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Desktop\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Documents\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Libraries\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Documents\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created F:\$RECYCLE.BIN\S-1-5-21-1232405761-1209240240-3206092754-1000\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Contacts\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Desktop\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\$Recycle.Bin\S-1-5-21-1232405761-1209240240-3206092754-1000\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Downloads\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\OneDrive\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Downloads\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Links\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Pictures\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Downloaded Program Files\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\AccountPictures\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Music\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Favorites\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Videos\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Public\Pictures\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Searches\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Users\Admin\Videos\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regedit.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\TableTextService.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Microsoft.PowerShell.Operation.Validation.Tests.ps1 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PowerShell.PackageManagement.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\System\msadc\msadcer.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Microsoft\Edge\Edge.dat.LOG1 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{E3F31D2A-B197-4F9F-94D4-A6BB8A6455B1}\MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\excluded.txt 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobePiStd.otf 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Internet Explorer\it-IT\ieinstal.exe.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\BreakAndContinue.Tests.ps1 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\en_CA.aff 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Media Player\WMPNSSUI.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\InkObj.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.181.5\EdgeUpdate.dat 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipres.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\excluded.txt 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\List.txt 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\PSGet.Resource.psd1 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows NT\Accessories\en-US\wordpad.exe.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\README.md 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\skchobj.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\System\msadc\msaddsr.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\EppManifest.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\InkDiv.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_75437\javaws.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\PSGet.Resource.psd1 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-Bold.otf 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Internet Explorer\en-US\ieinstal.exe.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\rtscom.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\en_GB.aff 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\java.settings.cfg 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Example2.Diagnostics.psd1 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\msdaer.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\affDescription.txt 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Program Files (x86)\Internet Explorer\ja-JP\iexplore.exe.mui 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files\ResolveOpen.css 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\concrt140.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\System.Data.Resources\2.0.0.0_de_b77a5c561934e089\System.Data.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\HelpPane.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P08ac43d5#\c22867030e5bfe64cd2f01ea2a121306\Microsoft.PowerShell.Utility.Activities.ni.dll.aux 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_de_31bf3856ad364e35\MMCFxCommon.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I7676db1a#\9761aa02e459394769888f74d97b844c\Microsoft.InternationalSettings.Commands.ni.dll.aux 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Boot\DVD\PCAT\BCD 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Cursors\aero_arrow_l.cur 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\PresentationCore.Resources\3.0.0.0_fr_31bf3856ad364e35\PresentationCore.resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\bfsvc.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\WindowsShell.Manifest 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04#\388060f20fb1e07633aee2746bdc3844\Microsoft.SecureBoot.Commands.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_en_31bf3856ad364e35\MMCFxCommon.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S0f8e494c#\f265296f3cbf5114818388ec01d3f658\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.Resources\2.0.0.0_de_b03f5f7f11d50a3a\System.DirectoryServices.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Excel.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.14.0.Microsoft.Office.Interop.Access.Dao\15.0.0.0__71e9bce111e9429c\Policy.14.0.Microsoft.Office.Interop.Access.Dao.config 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\System.IO.Log.Resources\3.0.0.0_de_b03f5f7f11d50a3a\System.IO.Log.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mff1be75b#\4364afb08a160ec916d9ec14a6f5b435\Microsoft.ManagementConsole.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.T9d753d8c#\22cbcb640b1d17e45820978a43df89f3\Microsoft.Tpm.Commands.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\MMCEx\62d027db4e48b2e35ce8272c55ed780e\MMCEx.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\mscorlib.Resources\2.0.0.0_es_b77a5c561934e089\mscorlib.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\DiagTrack\GetFileActionAllowedList.dat 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W0bb5dac4#\e340d15b0577ba6f1e950be4a75c873a\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll.aux 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_ja_31bf3856ad364e35\Microsoft.Ink.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_de_b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_es_31bf3856ad364e35\MMCEx.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W193497eb#\07d0fee6b2ba31e14624c84d372674bd\Microsoft.WSMan.Runtime.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Sentinel.v3.5Client\3.5.0.0__b03f5f7f11d50a3a\Sentinel.v3.5Client.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.Linq.Resources\3.5.0.0_de_b77a5c561934e089\System.Data.Linq.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\DiagTrack\analyticsevents.dat 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\DiagTrack\utc.privacy.diffbase 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\System.Net\3.5.0.0__b03f5f7f11d50a3a\System.Net.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P08ac43d5#\c22867030e5bfe64cd2f01ea2a121306\Microsoft.PowerShell.Utility.Activities.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_fr_31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_es_b03f5f7f11d50a3a\aspnetmmcext.resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\DiagTrack\GetFileInfoActionAllowedList.dat 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Security.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\lsasetup.log 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\sysmon.exe 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Downloaded Program Files\desktop.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\Boot\DVD\EFI\BCD 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P9de5a786#\7b5c5e18f54175c9d821602aea803caa\Microsoft.PowerShell.Management.Activities.ni.dll.aux 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\15.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Graph.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P39041136#\e4d801060ee6b97fa453ca883d98009b\Microsoft.PowerShell.ScheduledJob.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\diagnostics\system\Bluetooth\BluetoothDiagnosticUtil.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W0bb5dac4#\e340d15b0577ba6f1e950be4a75c873a\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\PFRO.log 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc#\00194bf840ef92b2565b539f29704dc8\AuditPolicyGPManagedStubs.Interop.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\mscorlib.Resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_de_b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.Resources.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\system.ini 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.PowerPoint.config 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\20b221b2aa56b5604f519dcf81704999\System.Xml.Linq.ni.dll 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe"C:\Users\Admin\AppData\Local\Temp\111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4748