Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1795s -
max time network
1799s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2024, 00:43
Static task
static1
Behavioral task
behavioral1
Sample
a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe
Resource
win10v2004-20240508-en
General
-
Target
a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe
-
Size
79KB
-
MD5
725e65aa9cb9f4e2e7e85f6893cd189f
-
SHA1
b785900d47cae459aace67417c7b2df977c012f0
-
SHA256
a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a
-
SHA512
7adddd2f38483ebf77d0cfd2967a02ebd2eaf6a7add751c6d5423034139f6d75b05d6a46b0bd3e36072882e4d7ad973612c2f2c610a16ce85515172bfa90f31b
-
SSDEEP
768:W7BlpDpARFbhYQkQjjIXYvPXzWPXzK3733uF4V7en5c5HChCrmhYCDPdICDPdoQc:W7ZDpApYbWjIoPyPoLzV7c6Sh1dldoQc
Malware Config
Signatures
-
Renames multiple (20477) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 27 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui.exe.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\gm.dls.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui.exe.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui.exe.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui.exe.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\afunix.sys.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui.exe.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectPlay-OC-Opt-WOW64-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PhotoBasic-Feature-WOW64-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WPD-UltimatePortableDeviceFeature-Feature-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\de-DE\wpdmtphw.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\en-US\e2xw10x64.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\fr-FR\wpdmtp.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms008.inf_amd64_69b5e0c918eab9a6\Amd64\unishare3d.gpd.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\en-US\dot3svc.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\wbem\ja-JP\PolicMan.mfl.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Vpci-VirtualDevice-DDA-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Lxss-Optional-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\es-ES\hdaudss.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\es-ES\urlmon.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\xwreg.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\Recovery\ReAgent.xml.exe.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ShellExperienceHost-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TextPrediction-Dictionaries-en-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\ja-JP\usbstor.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\es-ES\tapisrv.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\SCardDlg.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\uk-UA\hidbth.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\timeout.exe.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\en-US\acpipmi.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\en-US\netsstpa.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_360f6f3a7c4b3433\prnms003.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\it-IT\netsstpa.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\ja-JP\ir32_32original.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\uk-UA\pcaui.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-UX-UI-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Telnet-Client-Opt-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\FileRepository\mlx4_bus.inf_amd64_4c426f3bebc68844\mlx4_bus.sys.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\de-DE\TtlsCfg.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\ja-JP\unknown.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\KBDKOR.DLL.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\wbem\uk-UA\PS_MMAgent.mfl.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\en-US\PSDesiredStateConfiguration.Resource.psd1.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\wmidx.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0414~31bf3856ad364e35~amd64~~10.0.19041.264.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\directml.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\de-DE\netlldp.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\it-IT\c_fsencryption.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\wbem\es-ES\storagewmi_uninstall.mfl.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\en-US\PerceptionSimulationSixDof.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\it-IT\iagpio.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\fr-FR\inseng.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\it-IT\PeerDist.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\SmbServerConfiguration.cdxml.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\wsp_health.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\es-ES\itSAS35i.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_0e2452f597790e95\Amd64\PrintConfig.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\esentprf.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Feature-VirtualMachinePlatform-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\StateRepository.Core.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\ja-JP\MSFT_UserResource.schema.mfl.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\en-US\wvid.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\KBDFC.DLL.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\typelib.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\DriverStore\FileRepository\megasr.inf_amd64_72258921635be994\megasr.sys.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\it-IT\csrsrv.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\KBDTAT.DLL.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\vccorlib110.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SearchEngine-Client-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\Com\es-ES\MigRegDB.exe.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\SysWOW64\Dism\fr-FR\UnattendProvider.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_Flight.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\ui-strings.js.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\it-it\ui-strings.js.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\msedgeupdateres_lt.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-black_scale-200.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.mfl.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\LargeTile.scale-200.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\Square71x71Logo.scale-200.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-150.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Windows Defender\ja-JP\shellext.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailSmallTile.scale-200.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-24.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Resources\DefaultResourceDictionary.xaml.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-64_altform-unplated_contrast-white.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\ReceiveCheckpoint.docx.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\plugin.js.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\MSWDS_FR.LEX.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdca_plugin.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-focus_32.svg.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\Microsoft.VisualBasic.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-80_altform-lightunplated.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-32_altform-unplated.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_invite_24.svg.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\MedTile.scale-125.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.e511c6fe.pri.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\ui-strings.js.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\THMBNAIL.PNG.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libwindrive_plugin.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\MedTile.scale-125.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\PSGet.Resource.psd1.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeOfType.ps1.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Preview.scale-100_layoutdir-LTR.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_altform-unplated_contrast-white.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\VideoLAN\VLC\lua\http\favicon.ico.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-200_contrast-black.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_altform-unplated_contrast-white_devicefamily-colorfulunplated.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\ui-strings.js.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\msedgeupdateres_gl.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\MemMDL2.1.85.ttf.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-16_altform-unplated_contrast-black.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\or.pak.DATA.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\AppBridge.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\resources.pri.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\servicing\Packages\Microsoft-Windows-TerminalServices-AppServer-Client-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.mum.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..d-experience-smsapi_31bf3856ad364e35_10.0.19041.746_none_df620970ba05b4f3\mbsmsapi.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-s..ortingapi.resources_31bf3856ad364e35_10.0.19041.1_en-us_191f63fa93118876.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\domSelectAllBreakpoints.png.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..st-common.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c30587016df4e465\NetPeerDistCim.mfl.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..talcontrolssettings_31bf3856ad364e35_10.0.19041.264_none_d1ce115a6e50bd32\f\Wpc.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-p..ng-client-overrides_31bf3856ad364e35_10.0.19041.1266_none_8e5f726ca832e39d_power.settings.control.ppkg_03fe1683.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\FileMaps\$$_microsoft.net_assembly_gac_msil_system.data.resources_v4.0_4.0.0.0_fr_b77a5c561934e089_75c6ca92a9964a1c.cdf-ms.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_19a87c02033cbe34.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_45a6c0aa2ed16c7c\defaultbrowser.htm.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mtffuzzyds.resources_31bf3856ad364e35_10.0.19041.1_it-it_59360929969d735d\MTFFuzzyDS.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-media-audio_31bf3856ad364e35_10.0.19041.1266_none_46b4281ff6ecbf6c.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-n..rkprofile.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_8d403f952842c714.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..rotection.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_1811d27822587b8c.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..splay-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_f4d6eb1ca03f0589\ControlPanelDisplay.adml.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_10.0.19041.1_none_27770adb9e444fec\CntrtextMig.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Catalogs\559e599ca2e6b15bb582b86919e6cfc9f1d3e6377a67d97fa73be4a3ec7d422f.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\FileMaps\$$_system32_wbem_fr_026f11b1eca02217.cdf-ms.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-e..ftedgeenlightenment_31bf3856ad364e35_10.0.19041.546_none_8f16006ccdd3cf42.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\Boot\PCAT\ja-JP\memtest.exe.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\servicing\Packages\HyperV-Guest-KernelInt-Package~31bf3856ad364e35~amd64~~10.0.19041.844.mum.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..rcluster-clientcore_31bf3856ad364e35_10.0.19041.84_none_88eaa5a4667d05e5\f\resutils.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nativeeapmethods_31bf3856ad364e35_10.0.19041.1_none_a52e5bb675d303de\EAPAkaPrimeConnectionPropertiesV1.xsd.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Manifests\amd64_multimedia-mferror.resources_31bf3856ad364e35_10.0.19041.1_es-es_3128b43b8bb359eb.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\msil_system.xml.resources_b77a5c561934e089_10.0.19041.1_de-de_0b52b7c792bcf8f6\System.xml.Resources.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..pbinaries.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_554cc60153eef744\browscap.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-composable-dragdrop.resources_31bf3856ad364e35_10.0.19041.1_en-us_50057755f5d24563\ShellComponents.DragDrop.en-US.pri.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..xcorecomp.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5bf696b624a6fdfe\default.aspx.fr.resx.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrt-windowsgraphics_31bf3856ad364e35_10.0.19041.1151_none_7441c95d25d70905\Windows.Graphics.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-m..yer-setup.resources_31bf3856ad364e35_10.0.19041.1_it-it_2becedde70aa10c3.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..-socialrtcomponents_31bf3856ad364e35_10.0.19041.746_none_c3d092cb5e78a6ff\socialapis.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\servicing\Packages\microsoft-windows-RemoteFX-clientVM-RemoteFXWDDMDriver-WOW64-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.844_none_7eaa07ee55c22dcc\r\WinMgmt.exe.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-e..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_it-it_ae447d69f187061f.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010407_31bf3856ad364e35_10.0.19041.1_none_42faa0ebf4707868\KBDGR1.DLL.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\TileButton.xbf.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\FileMaps\$$_microsoft.net_assembly_gac_msil_system.directoryservices.resources_v4.0_4.0.0.0_ja_b03f5f7f11d50a_7d43d722f9d2b752.cdf-ms.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\popup.html.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_vdrvroot.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_071ca90aef89fb5c\vdrvroot.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft.windows.w..-non_msil.resources_31bf3856ad364e35_10.0.19041.1_en-us_6ed350b85bc769c7.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.19041.1_none_0e98e5367a9d834f\SFLISTWB.dat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.19041.1_it-it_21b80f3a6591f527.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.19041.1202_none_4f22e21b58d6c2e3.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\PolicyDefinitions\en-US\SmartScreen.adml.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..-security.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_32f71f9ba1370d27\nshwfp.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.19041.1_none_69cd9c22cfcf9358\Rules.System.Diagnostics.xml.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_whyperkbd.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_927da2fb396c3afe\whyperkbd.inf_loc.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-o..-base-vpn.resources_31bf3856ad364e35_10.0.19041.1_it-it_a4439fd8e31f57fc.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-s..spp-tools.resources_31bf3856ad364e35_10.0.19041.1_de-de_403d031763bc501a.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.19041.1_none_3b97be772075a03a\RdpSa.exe.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\ja\SqlPersistenceProviderLogic.sql.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3231016e2d98e0f2\DiagPackage.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..s-utildll.resources_31bf3856ad364e35_10.0.19041.1_de-de_4de302086a6e545a\utildll.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_windows-defender-ma..t-onecore.resources_31bf3856ad364e35_10.0.19041.1_en-us_2bcaa185b8d0e30a\ProtectionManagement.dll.mui.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..age-winrt-component_31bf3856ad364e35_10.0.19041.264_none_1af3391e0b7b766b\Windows.Gaming.XboxLive.Storage.dll.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Catalogs\17beef0bda4eb2e689f80813e73e5dfbd20e1fa6c9a69845d8b5bce0d99c0e29.cat.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\schemas\EAPMethods\mschapv2userpropertiesv1.xsd.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\f\ssprerror-page.js.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-mof_31bf3856ad364e35_10.0.19041.1_none_5867d3184f8e8a0d\interop.mof.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-kernel32_31bf3856ad364e35_10.0.19041.1202_none_12d2bc7d3fe2a244.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_web_config_b03f5f7f11d50a3a_10.0.19041.1_none_5f0132d8aee083d8\web.config.default.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Manifests\amd64_multimedia-restrict..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-us_76ec42f0d3ffb649.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Manifests\amd64_windows-id-connecte..-provider-tokenprov_31bf3856ad364e35_10.0.19041.746_none_ad8e2c77dad9fb8e.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe File created C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-c..fications.resources_31bf3856ad364e35_10.0.19041.1_de-de_69b6eceff17303fd.manifest.tmp a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4284 a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4284 wrote to memory of 2000 4284 a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe 104 PID 4284 wrote to memory of 2000 4284 a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe 104 PID 4284 wrote to memory of 2000 4284 a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe"C:\Users\Admin\AppData\Local\Temp\a62c2d7ccf33edfced2f449ecbc4e861c97870f66346eccc3ac3d8fb81db347a.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A62C2D~1.EXE > nul2⤵PID:2000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4532,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:81⤵PID:552
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3972,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:81⤵PID:4004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD589313542e03e32f2d244c76aa4189226
SHA1d49f92a7265df89f89a197b36d127394be3f1272
SHA256422a9b2d0f9f6be053735a866db027fcad89a2602390ce8a99488611e25981ab
SHA512e87ca65cb1fbe0c45e4b58f30d8bed470f90326e5dee2ab8e443029624cf52abbdc92a52d51446cb3e4e71357312b96a494fc9b3ddb9d4bc448229d2635999c6
-
Filesize
192KB
MD503eb814f96ea633c6218f9501caf865e
SHA182cc63a6ddb91cd0d7972618505540cf880b44c7
SHA2568d32e6f313a452194affe628fff7a347381e8245e9c9f5ef8d73d666f9629f41
SHA512a549c16c888f10bf6f9dde34563c20d8fac0be9f1c034f8b57842b67fb498d4917a3eea0c09de94e645234f989deae8f5489a1088d7ba52eaccc55332d888e8e