Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2024, 10:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
-
Target
f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe
-
Size
52KB
-
MD5
cb50be847a769122424e811b0a22aaf7
-
SHA1
07a61ae2503ac32f9f68a915cf8fa9f6ac518030
-
SHA256
f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8
-
SHA512
3a97191ef828f7c53175729a16276519d29882ab0ebde43b362da18201bca1cc99720ca5ba8f345e60475466451442f8d55c0dcc0a418239d580728282fd6aa4
-
SSDEEP
768:FlQ4hrvaEGU4aikqykezg2XpfY0jYioRoS8Gl5:fLhE1Dezg2ZfYZoXU5
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\AT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\CACLS.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\CONTROL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\REG.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\SDBINST.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\SECEDIT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\DVDPLAY.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\FINGER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\INSTNM.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\RELOG.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\ARP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\CTTUNESVR.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\LODCTR.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\LOGAGENT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\DOSKEY.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\MOBSYNC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\TCPSVCS.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WMIC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWS.MEDIA.BACKGROUNDPLAYBACK.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\ATBROKER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\BTHUDTASK.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\CERTUTIL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\CTTUNE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\NETSH.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\DPNSVR.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\LOGMAN.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_ISV.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\CALC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\NOTEPAD.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\UPNPCONT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\W32TM.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL_ISE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\REGEDIT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\SC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\USERACCOUNTCONTROLSETTINGS.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\WSCRIPT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\AUDITPOL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\CERTREQ.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\EUDCEDIT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\EXPLORER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\KTMUTIL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\NSLOOKUP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\RMCLIENT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\TASKKILL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\USER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\CAMERASETTINGSUIHOST.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\CHKDSK.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\EXPAND.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\PATHPING.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\REPLACE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\WHERE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\MAGNIFY.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\TIMEOUT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\XCOPY.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\NTPRINT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESPROTECTION.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\AUTOCHK.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\RDRLEAKDIAG.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTRAY.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\EHSTORAUTHN.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\FSUTIL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\HDWWIZ.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\MSPAINT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\SysWOW64\PKGMGR.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\FULLTRUSTNOTIFIER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAFXPACKAGER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KLIST.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.STOREPURCHASEAPP_11811.1001.18.0_X64__8WEKYB3D8BBWE\STOREEXPERIENCEHOST.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DISABLEDGOOGLEUPDATE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\VPREVIEW.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.GETSTARTED_8.2.22942.0_X64__8WEKYB3D8BBWE\WHATSNEW.STORE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MSPAINT_6.1907.29027.0_X64__8WEKYB3D8BBWE\PAINTSTUDIO.VIEW.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.OFFICE.ONENOTE_16001.12026.20112.0_X64__8WEKYB3D8BBWE\ONENOTESHARE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATEBROKER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\WOW_HELPER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\122.0.2365.52\NOTIFICATION_HELPER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\LOGTRANSPORT2.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\OFFICEAPPGUARDWIN32.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\POWERPNT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\122.0.2365.52\MSEDGEWEBVIEW2.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.17\MICROSOFTEDGEUPDATEONDEMAND.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOEV.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\122.0.2365.52\MSEDGE_PROXY.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\MSINFO\MSINFO32.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\PACK200.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JABSWITCH.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WEBPIMAGEEXTENSION_1.0.22753.0_X64__8WEKYB3D8BBWE\CODECPACKS.WEBP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.ZUNEVIDEO_10.19071.19011.0_X64__8WEKYB3D8BBWE\VIDEO.UI.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVAWS.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSCOMMUNICATIONSAPPS_16005.11629.20316.0_X64__8WEKYB3D8BBWE\HXCALENDARAPPIMM.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVA-RMI.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\PUBS.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWS PHOTO VIEWER\IMAGINGDEVICES.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEINSTAL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOTD.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSQRY32.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSSOUNDRECORDER_10.1906.1972.0_X64__8WEKYB3D8BBWE\SOUNDREC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\122.0.2365.52\MSEDGEWEBVIEW2.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\POLICYTOOL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\RMID.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ORGCHART.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\DOTNET\SHARED\MICROSOFT.NETCORE.APP\6.0.25\CREATEDUMP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SDXHELPER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME_PROXY.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH_TARGET_156609\JAVA.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\DEFAULT-BROWSER-AGENT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KINIT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\JOTICON.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPCONFIG.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.SKYPEAPP_14.53.77.0_X64__KZF8QXF38ZG5C\SKYPEBRIDGE\SKYPEBRIDGE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\INSTALLER\CHRMSTP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\NAMECONTROLSERVER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.549981C3F5F10_1.1911.21713.0_X64__8WEKYB3D8BBWE\WIN32BRIDGE.SERVER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPLAYER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZFM.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\MIP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\ORBD.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KTAB.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\READER_SL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAH.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JHAT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVAW.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PRIVATE_BROWSING.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSCAMERA_2018.826.98.0_X64__8WEKYB3D8BBWE\WINDOWSCAMERA.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURESTARTUP-CPL_31BF3856AD364E35_10.0.19041.1202_NONE_CC46843E404EB749\BITLOCKERWIZARDELEV.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..NPUTPERSONALIZATION_31BF3856AD364E35_10.0.19041.1_NONE_F59D207965B1BBC3\INPUTPERSONALIZATION.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-B..MENT-WINDOWS-MINWIN_31BF3856AD364E35_10.0.19041.1266_NONE_C4B179E0B12FE4B9\WINLOAD.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IEINSTAL_31BF3856AD364E35_11.0.19041.1_NONE_D27E617A9BD9C1D3\IEINSTAL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MAGNIFY_31BF3856AD364E35_10.0.19041.84_NONE_65D0F4A4C6CD4975\MAGNIFY.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SAFEDOCS-MAIN_31BF3856AD364E35_10.0.19041.264_NONE_02EB5D2EC5A9EC02\F\SDCLT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MICROSOFTEDGE_31BF3856AD364E35_10.0.19041.264_NONE_EF195F564F00D259\MICROSOFTEDGE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MSCONFIG-EXE_31BF3856AD364E35_10.0.19041.1110_NONE_4F46693352ED3250\F\MSCONFIG.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SERVICINGSTACK_31BF3856AD364E35_10.0.19041.1_NONE_BF506ECC66A800DF\TIFILEFETCHER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..VERCOMMANDLINETOOLS_31BF3856AD364E35_10.0.19041.1_NONE_70349C6644208282\FLATTEMP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PNPUTIL_31BF3856AD364E35_10.0.19041.1151_NONE_7233D7A171B1272A\PNPUTIL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PNPUTIL_31BF3856AD364E35_10.0.19041.1_NONE_B354D0155BE50CE9\PNPUTIL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TCPIP_31BF3856AD364E35_10.0.19041.746_NONE_3F7EE0A8EE28EF7D\NETIOUGC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DATASVCUTIL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..OMMANDLINE-ADAMSYNC_31BF3856AD364E35_10.0.19041.1081_NONE_6700B2D2D3C0055F\F\ADAMSYNC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..NT-BROWSER.APPXMAIN_31BF3856AD364E35_10.0.19041.1_NONE_B1E502C19C2A358B\SECUREASSESSMENTBROWSER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-OPTIONALFEATURES_31BF3856AD364E35_10.0.19041.1_NONE_1C5807CD8D0C767E\OPTIONALFEATURES.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-BOOTUX.DEPLOYMENT_31BF3856AD364E35_10.0.19041.1_NONE_F4025A506F9E9F01\BOOTIM.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MDMAPPINSTALLER_31BF3856AD364E35_10.0.19041.844_NONE_77A5D9AAFAE08E77\R\MDMAPPINSTALLER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-UNP_31BF3856AD364E35_10.0.19041.264_NONE_8ADC8BD8B75D383F\F\UPDATENOTIFICATIONMGR.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-SPP-UX-DLG_31BF3856AD364E35_10.0.19041.746_NONE_7C508E4438CEC899\PHONEACTIVATE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_OPENSSH-CLIENT-COMPONENTS-ONECORE_31BF3856AD364E35_10.0.19041.964_NONE_DDDEEA757B7FBBA7\SSH.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CASPOL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-AXINSTALLSERVICE_31BF3856AD364E35_10.0.19041.153_NONE_B4F0BD83CFC7701E\F\AXINSTUI.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-BCDBOOT-CMDLINETOOL_31BF3856AD364E35_10.0.19041.1237_NONE_D618A074F3588A53\BCDBOOT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..ALCONTROLS.APPXMAIN_31BF3856AD364E35_10.0.19041.1_NONE_595F2A7ACAF53BBA\WPCUAPAPP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CONTROL_31BF3856AD364E35_10.0.19041.423_NONE_7777DD52093F9DD6\F\CONTROL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..INSTALLERANDPRINTUI_31BF3856AD364E35_10.0.19041.264_NONE_B435E08254CDA322\F\PRINTUI.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-REFSUTIL_31BF3856AD364E35_10.0.19041.1202_NONE_5F774093E49B3593\REFSUTIL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SMARTSCREEN_31BF3856AD364E35_10.0.19041.264_NONE_9B436D497F039D6D\SMARTSCREEN.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WIMGAPI_31BF3856AD364E35_10.0.19041.1202_NONE_FDBBCF53CA14E151\WIMSERV.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SENSORDATASERVICE_31BF3856AD364E35_10.0.19041.1_NONE_B3F4F49AC9993D28\SENSORDATASERVICE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..ETEXPLORER-OPTIONAL_31BF3856AD364E35_11.0.19041.1_NONE_8298E4B5B7FD2C26\IEXPLORE.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NETBT_31BF3856AD364E35_10.0.19041.572_NONE_3E399E76562F6053\NETBTUGC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-OS-KERNEL_31BF3856AD364E35_10.0.19041.264_NONE_4A12028313046A9E\R\NTOSKRNL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RUNDLL32_31BF3856AD364E35_10.0.19041.746_NONE_B5FE9C5C09B9D7A9\RUNDLL32.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ATBROKER_31BF3856AD364E35_10.0.19041.1023_NONE_4478665ED379A3FC\ATBROKER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-BLB-CLI-MAIN_31BF3856AD364E35_10.0.19041.264_NONE_29367E02EDE71097\R\WBADMIN.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WMI-CORE_31BF3856AD364E35_10.0.19041.1081_NONE_2E31E8EED4B770C3\F\MOFCOMP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-TOOLS-KSETUP_31BF3856AD364E35_10.0.19041.1_NONE_D25DD411ED85E6BA\KSETUP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SYSTEMRESET_31BF3856AD364E35_10.0.19041.153_NONE_C8FBED52DAD932CB\SYSTEMRESET.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WININIT_31BF3856AD364E35_10.0.19041.1202_NONE_A5B2E5B8B986FE3D\WININIT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NOTEPAD_31BF3856AD364E35_10.0.19041.1081_NONE_E3F87355251E8C43\F\NOTEPAD.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-OPENFILES_31BF3856AD364E35_10.0.19041.1_NONE_9D17748489C1B07E\OPENFILES.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..NT-ENROLLMENTHELPER_31BF3856AD364E35_10.0.19041.746_NONE_18C3DDF7DBFEDDA0\F\PINENROLLMENTBROKER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..RIENCEHOST.APPXMAIN_31BF3856AD364E35_10.0.19041.1151_NONE_71AA7FDBB41824A0\SHELLEXPERIENCEHOST.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-GAMING-GA..RNAL-PRESENCEWRITER_31BF3856AD364E35_10.0.19041.1202_NONE_76E6FB38A70DBD6D\GAMEBARPRESENCEWRITER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-D..S-VMSWITCH-NETSETUP_31BF3856AD364E35_10.0.19041.1288_NONE_F92F7256107C0E35\R\NVSPINFO.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..-EASHARED-IMEBROKER_31BF3856AD364E35_10.0.19041.84_NONE_81616275259E37FE\IMEBROKER.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MSINFO32-EXE-COMMON_31BF3856AD364E35_10.0.19041.1110_NONE_FB1129CAA00E000F\MSINFO32.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IIS-SHAREDLIBRARIES_31BF3856AD364E35_10.0.19041.906_NONE_EF0E010D1381269B\IISRSTAS.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..IONINGSECUREPROCESS_31BF3856AD364E35_10.0.19041.1_NONE_4CC7187CBF1EF970\PSP.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..CSENGINE-NATIVEHOST_31BF3856AD364E35_10.0.19041.1_NONE_D016F232FBEEFBAD\SDIAGNHOST.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-U..CLIENT-DECODER-HOST_31BF3856AD364E35_10.0.19041.662_NONE_0070027DAB4E4FFE\UTCDECODERHOST.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPREP-CHXAPP.APPXMAIN_31BF3856AD364E35_10.0.19041.1_NONE_EDDA8130B19D4286\CHXSMARTSCREEN.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..-COMMANDLINE-DSMGMT_31BF3856AD364E35_10.0.19041.1_NONE_00C77B5A9E4F1BEE\DSMGMT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DATAEXCHANGEHOST_31BF3856AD364E35_10.0.19041.264_NONE_C765D8A6C76EC25F\DATAEXCHANGEHOST.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IEFRAME_31BF3856AD364E35_11.0.19041.1288_NONE_1D22271C8CC35D4B\F\IESETTINGSYNC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WIFINETWORKMANAGER_31BF3856AD364E35_10.0.19041.1202_NONE_E17F082B30DD9027\WIFITASK.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-X..JECTDIALOG.APPXMAIN_31BF3856AD364E35_10.0.19041.423_NONE_D93EE361FBBC8F0A\F\XGPUEJECTDIALOG.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_SERVICEINITIATEDHEALING-CLIENT_31BF3856AD364E35_10.0.19041.1_NONE_D2CF62416598C002\SIHCLIENT.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-B..MENT-WINDOWS-MINWIN_31BF3856AD364E35_10.0.19041.173_NONE_2DC175215AE8EC39\F\WINLOAD.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CSC.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_REGSQL_B03F5F7F11D50A3A_4.0.15805.0_NONE_AADF84CDA75DA02D\ASPNET_REGSQL.EXE f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3012 f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe 3012 f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe"C:\Users\Admin\AppData\Local\Temp\f7a5e46b5ba29714a55d539aa7eecd7336361451fc05b08099ac3b7dae528dd8.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3012
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3940 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:81⤵PID:3020