Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 03:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe
-
Size
48KB
-
MD5
162bfd3425f29ccc35e5575a2cd9af10
-
SHA1
9ab2b64ce99795cdb16f194a7e7f45f57117dfc4
-
SHA256
314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf
-
SHA512
c9b5e0ffde0939700183de484aa2f32cc89b15f4186ebe56321b5c97a4ca74d471c4ed7f3eb8af1dbcb16bdf371e19906c64e423d9e0e6d14255188d3e8d03d1
-
SSDEEP
768:pwv4s7UUpOvj8u4Mf4MMRt4Mtx6doKihJyJmMJeg+NiTYioRo8qD1p:pwvvoqO4uP875yJcg+Nfo8gp
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\RELOG.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\WRITE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\DLLHST3G.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\MIGWIZ\POSTMIG.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\MSPAINT.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\RECOVER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\RPCPING.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\SHRPUBW.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\MIGWIZ\MIGSETUP.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\SDIAGNHOST.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\REGSVR32.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\RRINSTALLER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\W32TM.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\CLEANMGR.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\DXDIAG.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\FORFILES.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\CHARMAP.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\CMMON32.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\FINDSTR.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\VSSADMIN.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\ODBCCONF.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\WERFAULT.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\OSK.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\POQEXEC.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\OSK.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\SC.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\DIANTZ.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\NET1.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\NOTEPAD.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\SEARCHFILTERHOST.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\WIAACMGR.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\DRVINST.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\CLIP.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\RUNLEGACYCPLELEVATED.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\WHERE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\RASPHONE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\SETUP16.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\DWWIN.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\INFDEFAULTINSTALL.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\REG.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\RMACTIVATE_SSP_ISV.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\WSCRIPT.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\DISKPART.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\EVENTCREATE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP10\IMJPDSVR.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\MMC.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\REGEDT32.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\CHKNTFS.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\LODCTR.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\COMP.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\DISKPERF.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\MMC.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\NOTEPAD.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\TAKEOWN.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\SDCHANGE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\FIXMAPI.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\DVDPLAY.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\HOSTNAME.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\MSRA.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\FSUTIL.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SysWOW64\WHERE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\DDODIAG.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\MOUNTVOL.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SYSWOW64\SECEDIT.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JCONSOLE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\SSVAGENT.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\CRASHREPORTER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\WINDOWS JOURNAL\JOURNAL.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPCONFIG.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ACRORD32INFO.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\NAMECONTROLSERVER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JAVAWS.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPDMC.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVACPL.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KINIT.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\A3DUTILITY.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\LICLUA.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\INKWATSON.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATESETUP.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\CONVERTINKSTORE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAFXPACKAGER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KLIST.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSOHTMED.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC-CACHE-GEN.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\UPDATER6\ADOBEUPDATERINSTALLMGR.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\SOURCE ENGINE\OSE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATEBROKER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATECORE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JHAT.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\SOLITAIRE\SOLITAIRE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\EULA.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\SERIALVER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JAVA.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PRIVATE_BROWSING.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPSIDESHOWGADGET.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\UPDATER6\ADOBE_UPDATER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MINIDUMP-ANALYZER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\KINIT.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\SCANPST.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\SELFCERT.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JSTACK.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JP2LAUNCHER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\ORBD.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\CHESS\CHESS.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WINMAIL.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JINFO.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPSHARE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\MSOXMLED.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPSHARE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\MIP.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\INSTALLER\CHRMSTP.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVA.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\WINDOWS PHOTO VIEWER\IMAGINGDEVICES.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\RMIREGISTRY.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KEYTOOL.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\EXTEXPORT.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSTORDB.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPCONFIG.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVA-RMI.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE_INSTALLER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVA-RMI.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JABSWITCH.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\PURBLE PLACE\PURBLEPLACE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MSAUDITEVTLOG_31BF3856AD364E35_6.1.7600.16385_NONE_23376BF5921E7B63\AUDITPOL.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WPF-XAMLVIEWER_31BF3856AD364E35_6.1.7601.17514_NONE_B43451F0938C6CD0\XAMLVIEWER_V0300.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-F..CLIENT-APPLICATIONS_31BF3856AD364E35_6.1.7601.17514_NONE_D71FB1D63F05EF22\FXSCOVER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..OR-NATIVE-SERVERBOX_31BF3856AD364E35_6.1.7601.17514_NONE_CDE4C4FD7AB159CB\RMACTIVATE_SSP.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WININIT_31BF3856AD364E35_6.1.7600.16385_NONE_8CE7AA761E01AD49\WININIT.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\VBC.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EHOME-MCGLIDHOST_31BF3856AD364E35_6.1.7600.16385_NONE_05A2B72417EC1C6A\MCGLIDHOST.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\LOADMXF\D09B54CD68BC772B3BE3832926E940D4\LOADMXF.NI.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\EDMGEN.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..ETEXPLORER-OPTIONAL_31BF3856AD364E35_8.0.7601.17514_NONE_1196A9003B674A92\IEXPLORE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-TOOLS-KSETUP_31BF3856AD364E35_6.1.7600.16385_NONE_7861B83567D966E6\KSETUP.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURESTARTUP-PROMPT_31BF3856AD364E35_6.1.7600.16385_NONE_4C045EC8FDA52D34\FVEPROMPT.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SESSION0VIEWER_31BF3856AD364E35_6.1.7600.16385_NONE_3DDBD9A9605F0519\UI0DETECT.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-VIRTUALDISKSERVICE_31BF3856AD364E35_6.1.7601.17514_NONE_C910D80F114E267A\VDS.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\ADDINPROCESS.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EVENTCOLLECTOR_31BF3856AD364E35_6.1.7600.16385_NONE_5702948E8E63FC30\WECUTIL.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WMI-CORE_31BF3856AD364E35_6.1.7601.17514_NONE_177A088436382A34\UNSECAPP.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..ANDLINEPROPERTYTOOL_31BF3856AD364E35_6.1.7601.17514_NONE_696354579779EADF\IMJPUEXC.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IRFTP_31BF3856AD364E35_6.1.7600.16385_NONE_B2AF329397F29F60\IRFTP.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..NPUTPERSONALIZATION_31BF3856AD364E35_6.1.7600.16385_NONE_9BA1049CE0053BEF\SHAPECOLLECTOR.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WMI-CORE-PROVIDERHOST_31BF3856AD364E35_6.1.7601.17514_NONE_6E88C3FAA2049408\WMIPRVSE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-FEEDSBS_31BF3856AD364E35_11.2.9600.16428_NONE_DEA50217EFD0356B\MSFEEDSSYNC.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..LEPC-MOBILITYCENTER_31BF3856AD364E35_6.1.7601.17514_NONE_B8BFFA4921E2A435\MBLCTR.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_REGSVCS_B03F5F7F11D50A3A_6.1.7601.17514_NONE_76DE745B101F0148\REGSVCS.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\COMSVCCONFIG\5F1A06C0108B2C81CDE1DC491D74043D\COMSVCCONFIG.NI.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_REGBROWSERS.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NSLOOKUP_31BF3856AD364E35_6.1.7601.17514_NONE_29A6795F7D1218C6\NSLOOKUP.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..UNTERINFRASTRUCTURE_31BF3856AD364E35_6.1.7600.16385_NONE_CD7AEEFF1897D018\LODCTR.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..CESFRAMEWORK-CTFMON_31BF3856AD364E35_6.1.7600.16385_NONE_F9257E7AAA4290CE\CTFMON.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ADAPTERTROUBLESHOOTER_31BF3856AD364E35_6.1.7600.16385_NONE_2DF6395B9CF7E9A5\ADAPTERTROUBLESHOOTER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DIRECTSHOW-DVDUPGRD_31BF3856AD364E35_6.1.7600.16385_NONE_D9BB586FF6564BBC\DVDUPGRD.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RECOVER_31BF3856AD364E35_6.1.7600.16385_NONE_E2083F75CE4C0619\RECOVER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..DEVICESCONTROLPANEL_31BF3856AD364E35_6.1.7600.16385_NONE_8094BD7B62D2B435\IMAGINGDEVICES.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SCRIPTING_31BF3856AD364E35_6.1.7600.16385_NONE_A45D44BD1A0AF822\WSCRIPT.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-VSSADMIN_31BF3856AD364E35_6.1.7600.16385_NONE_207247174B54AF00\VSSADMIN.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\WSATCONFIG.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ANYTIME-UPGRADE_31BF3856AD364E35_6.1.7600.16385_NONE_FB591B6CF023ADE3\WINDOWSANYTIMEUPGRADE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NOTEPAD_31BF3856AD364E35_6.1.7600.16385_NONE_CB0F7F2289B0C21A\NOTEPAD.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\EHEXTHOST32\C899DE3549784161AA66610D5735E4F0\EHEXTHOST32.NI.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ES-AUTHENTICATION_31BF3856AD364E35_6.1.7600.16385_NONE_9DB1AE483049E160\EHSTORAUTHN.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..-JAPANESE-UTILITIES_31BF3856AD364E35_6.1.7601.17514_NONE_4B57445488BA33FD\IMJPDADM.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-SETUP-SUPPORT_31BF3856AD364E35_8.0.7601.17514_NONE_3EB101CAEC1ACC2C\IE4UINIT.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..RASTRUCTURECONSUMER_31BF3856AD364E35_6.1.7601.17514_NONE_1202940E4711971E\PLASRV.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..OMMAND-LINE-UTILITY_31BF3856AD364E35_6.1.7600.16385_NONE_FD9EC705E687F8C2\WMIC.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\DATASVCUTIL.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WPF\PRESENTATIONFONTCACHE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-UPNPDEVICEHOST_31BF3856AD364E35_6.1.7600.16385_NONE_1DDD261C4E350476\UPNPCONT.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DFSVC.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-BASIC-MISC-TOOLS_31BF3856AD364E35_6.1.7600.16385_NONE_7351A917D91C961E\EXPAND.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAFOUNDATION_31BF3856AD364E35_6.1.7601.17514_NONE_FA8534AB236134C4\RRINSTALLER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SNMP-EVNTCMD_31BF3856AD364E35_6.1.7600.16385_NONE_14F9B9481DB6293B\EVNTCMD.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_6.1.7601.17514_NONE_42D65ED50FA3C682\SHADOW.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-MSCORSVW_EXE_B03F5F7F11D50A3A_6.1.7600.16385_NONE_ACD03D9B9048BD78\MSCORSVW.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\COMSVCCONFIG\D632B7434F821829827657E23AC98589\COMSVCCONFIG.NI.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\COMSVCCONFIG\2BD538D545E15452202EF3B41080E2CE\COMSVCCONFIG.NI.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\INSTALLER\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_READER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..G-XPSDOCUMENTWRITER_31BF3856AD364E35_6.1.7601.17514_NONE_80FEA45979A5D3F2\MXDWGC.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EHOME-DEVICES-MCXTASK_31BF3856AD364E35_6.1.7600.16385_NONE_B6BC1AAE9D0693C5\MCXTASK.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WCF-M_SM_CFG_INS_EXE_31BF3856AD364E35_6.1.7601.17514_NONE_5E47617F33C574AC\SMCONFIGINSTALLER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORSVW.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\SERVICING\TRUSTEDINSTALLER.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CLEANMGR_31BF3856AD364E35_6.1.7600.16385_NONE_C9392808773CD7DA\CLEANMGR.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CONSOLEHOST_31BF3856AD364E35_6.1.7601.22091_NONE_D2B1C721321AADF8\CONHOST.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..-SETIEINSTALLEDDATE_31BF3856AD364E35_11.2.9600.16428_NONE_EACE14B8D6178CCA\SETIEINSTALLEDDATE.EXE 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2220 314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe"C:\Users\Admin\AppData\Local\Temp\314ffa71a9d65a4387cf990bbebe4a37b768f32505e3bb74c62eeb3fbdfe0bcf.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2220