Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
54s -
max time network
63s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
07/07/2024, 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
General
-
Target
58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe
-
Size
92KB
-
MD5
99ff66d4ab145ca5e2eac34152bce13f
-
SHA1
815a46c79b06426494c0d0ce5a7a66e94202416a
-
SHA256
58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1
-
SHA512
f5adce95a87564a49fc1da0882b64ab0e5d079e0535b745d88aeb791935f76ea960a4756ff22d41b23922f958b6ff0f5c56e590d922b9107252f85b1e9ea8e03
-
SSDEEP
1536:DHB0UxMkzOt7HcvJGt5AdHIOWnToIf12ZqTUgacotpo:DhAWJGSCTBf12Z1g1otp
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\CHECKNETISOLATION.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\CMSTP.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\DLLHOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\EHSTORAUTHN.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\FSUTIL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHPROTOCOLHOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\WSMANHTTPCONFIG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\BOOTCFG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPDCT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESREMOTE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\DISM.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\ISCSICPL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\LOGMAN.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\PRESENTATIONHOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\FC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMESEARCH.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\PCAUI.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\PROQUOTA.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\USERACCOUNTCONTROLSETTINGS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\BYTECODEGENERATOR.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\CACLS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\CERTREQ.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\DFRGUI.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\FINGER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\FIXMAPI.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\NDADMIN.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\RECOVER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\SCHTASKS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\SDBINST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\TYPEPERF.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\MOBSYNC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\REGEDT32.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\STORDIAG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESADVANCED.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\WINVER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\DLLHST3G.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\DWWIN.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\MSPAINT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\MUIUNATTEND.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\LAUNCHWINAPP.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\MMC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\MSFEEDSSYNC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\REGINI.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHFILTERHOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\WINRTNETMUAHOSTSERVER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\DISM\DISMHOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\SDCHANGE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESHARDWARE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\THUMBNAILEXTRACTIONHOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\TPMINIT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\FORFILES.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\NETCFGNOTIFYOBJECTHOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\PREVHOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\SXSTRACE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\BITSADMIN.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_SSP_ISV.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\TIMEOUT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\CMD.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\FLTMC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\ISCSICLI.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\REKEYWIZ.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\TASKMGR.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\NETBTUGC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SysWOW64\RMCLIENT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7ZFM.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\XJC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\VISICON.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.STOREPURCHASEAPP_11811.1001.18.0_X64__8WEKYB3D8BBWE\STOREEXPERIENCEHOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE_PROXY.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPRPH.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\INSTALL\{14DF0EF0-439C-4CF1-9E8A-D1E954BF645B}\CHROME_INSTALLER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SKYPESRV\SKYPESERVER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\OLICENSEHEARTBEAT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PRIVATE_BROWSING.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTSOLITAIRECOLLECTION_4.4.8204.0_X64__8WEKYB3D8BBWE\MICROSOFT.MICROSOFTSOLITAIRECOLLECTION.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSMAPS_5.1906.1972.0_X64__8WEKYB3D8BBWE\MAPS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\LOGTRANSPORT2.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTSOLITAIRECOLLECTION_4.4.8204.0_X64__8WEKYB3D8BBWE\SOLITAIRE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\INPUTPERSONALIZATION.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\TABTIP.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JPS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\RMIREGISTRY.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\RMID.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC-CACHE-GEN.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOXIDENTITYPROVIDER_12.50.6001.0_X64__8WEKYB3D8BBWE\XBOXIDP.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.549981C3F5F10_1.1911.21713.0_X64__8WEKYB3D8BBWE\CORTANA.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\BHO\IE_TO_EDGE_STUB.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\MIP.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVA.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAP.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAW.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\MSOXMLED.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\COMMON.SHOWHELP.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PERFBOOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.SCREENSKETCH_10.1907.2471.0_X64__8WEKYB3D8BBWE\SCREENSKETCH.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\EXTEXPORT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEDIAGCMD.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\EXTCHECK.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\POLICYTOOL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\TNAMESERV.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVAW.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.SKYPEAPP_14.53.77.0_X64__KZF8QXF38ZG5C\SKYPEAPP.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\SHAPECOLLECTOR.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\OUTICON.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE_INSTALLER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\INSTALLER\SETUP.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7Z.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JABSWITCH.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\RMID.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UPDATER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSCOMMUNICATIONSAPPS_16005.11629.20316.0_X64__8WEKYB3D8BBWE\HXTSR.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH_TARGET_96109\JAVAW.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\MOZILLA MAINTENANCE SERVICE\UNINSTALL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\SSVAGENT.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\CLVIEW.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\JOTICON.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSCOMMUNICATIONSAPPS_16005.11629.20316.0_X64__8WEKYB3D8BBWE\HXACCOUNTS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACRORD32INFO.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\BROWSER\WCCHROMEEXTN\WCCHROMENATIVEMESSAGINGHOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVSHNOTIFY.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OFFICECLICKTORUN.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\110.0.5481.104\ELEVATION_SERVICE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME_PROXY.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\SOURCE ENGINE\OSE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\CRASHREPORTER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-CONTAINERDIAGNOSTICSTOOL_31BF3856AD364E35_10.0.19041.1_NONE_3D521DEDD6C76700\HCSDIAG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-C..PERIENCEHOST-BROKER_31BF3856AD364E35_10.0.19041.746_NONE_1CE3C0F12FB5F8EC\CLOUDEXPERIENCEHOSTBROKER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DFSVC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ILASM.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.OOBENETWORKCAPTIVEPORTAL_CW5N1H2TXYEWY\OOBENETWORKCAPTIVEPORTAL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\WINDOWS.CBSPREVIEW_CW5N1H2TXYEWY\CAMERABARCODESCANNERPREVIEW.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_REGSQL_B03F5F7F11D50A3A_10.0.19041.1_NONE_C9157DDC38B83B1B\ASPNET_REGSQL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMMANDLINE-TOOL_31BF3856AD364E35_10.0.19041.928_NONE_0B17415AE0DD0379\HVC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.PEOPLEEXPERIENCEHOST_CW5N1H2TXYEWY\PEOPLEEXPERIENCEHOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADOBE-FLASH-FOR-WINDOWS_31BF3856AD364E35_10.0.19041.1_NONE_E190F18A08ED1A44\FLASHUTIL_ACTIVEX.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\IEEXEC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CVTRES.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-I..ATEDUSERMODE-KERNEL_31BF3856AD364E35_10.0.19041.1023_NONE_5C93EF2449C89609\R\SECUREKERNEL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SMSVCHOST\V4.0_4.0.0.0__B03F5F7F11D50A3A\SMSVCHOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\ADDINPROCESS32.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCORSVW.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-VSTACK-VMMS_31BF3856AD364E35_10.0.19041.264_NONE_1477A882BDCE0DF2\R\VMMS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-I..ATEDUSERMODE-KERNEL_31BF3856AD364E35_10.0.19041.1023_NONE_5C93EF2449C89609\F\SECUREKERNEL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_64\MSBUILD\3.5.0.0__B03F5F7F11D50A3A\MSBUILD.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ACRORD32INFO.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\LOGTRANSPORT2.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\DFSVC\2.0.0.0__B03F5F7F11D50A3A\DFSVC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ADDINPROCESS32.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-CLIENT-LI..M-SERVICE-MIGRATION_31BF3856AD364E35_10.0.19041.1052_NONE_0BDE546BCAF8E34A\R\CLIPUP.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-DRIVERS-HYPERVISOR_31BF3856AD364E35_10.0.19041.264_NONE_0E32F443C4669FED\F\HVAX64.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-D..ECTXDATABASEUPDATER_31BF3856AD364E35_10.0.19041.84_NONE_2D21E26A18D595C7\F\DIRECTXDATABASEUPDATER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CVTRES.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.OOBENETWORKCONNECTIONFLOW_CW5N1H2TXYEWY\OOBENETWORKCONNECTIONFLOW.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.SECUREASSESSMENTBROWSER_CW5N1H2TXYEWY\SECUREASSESSMENTBROWSER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_REGSQL_B03F5F7F11D50A3A_4.0.15805.0_NONE_AADF84CDA75DA02D\ASPNET_REGSQL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-ONLINESETUP-COMPONENT_31BF3856AD364E35_10.0.19041.746_NONE_4B0A936D86CDD479\F\WINDEPLOY.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DATASVCUTIL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-ONLINESETUP-COMPONENT_31BF3856AD364E35_10.0.19041.746_NONE_4B0A936D86CDD479\WINDEPLOY.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\INSTALLUTIL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.CREDDIALOGHOST_CW5N1H2TXYEWY\CREDDIALOGHOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\SHELLEXPERIENCEHOST_CW5N1H2TXYEWY\SHELLEXPERIENCEHOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADDINPROCESS32_B77A5C561934E089_10.0.19041.1_NONE_3700BDC08C446A5C\ADDINPROCESS32.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-HOST-SERVICE_31BF3856AD364E35_10.0.19041.264_NONE_D58A0CA50A94510C\F\VMCOMPUTE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\PRINTDIALOG\PRINTDIALOG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-CLIENT-LI..M-SERVICE-MIGRATION_31BF3856AD364E35_10.0.19041.84_NONE_8EA6A37043F4AE90\CLIPUP.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\VBC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.FILEPICKER_CW5N1H2TXYEWY\FILEPICKER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_EDMGEN_B77A5C561934E089_4.0.15805.0_NONE_AE80A3049486A75F\EDMGEN.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-CLIENT-LI..ING-PLATFORM-CLIENT_31BF3856AD364E35_10.0.19041.1266_NONE_7E2B6BE969016C27\R\LICENSINGDIAG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_REGBROWSERS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\JSC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\WSATCONFIG.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\DATASVCUTIL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DFSVC.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-I..ATEDUSERMODE-KERNEL_31BF3856AD364E35_10.0.19041.207_NONE_C5E1B9DEF3522696\F\SECUREKERNEL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4BITMAPIBROKER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_REGIIS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ADDINUTIL.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.BIOENROLLMENT_CW5N1H2TXYEWY\BIOENROLLMENTHOST.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ILASM.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-DRIVERS-HYPERVISOR_31BF3856AD364E35_10.0.19041.1288_NONE_A518F9EB1AB503D0\R\HVIX64.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-C..PERIENCEHOST-BROKER_31BF3856AD364E35_10.0.19041.746_NONE_1CE3C0F12FB5F8EC\R\CLOUDEXPERIENCEHOSTBROKER.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.ASYNCTEXTSERVICE_8WEKYB3D8BBWE\MICROSOFT.ASYNCTEXTSERVICE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.APPREP.CHXAPP_CW5N1H2TXYEWY\CHXSMARTSCREEN.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\NGEN.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_REGIIS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\EDMGEN.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_STATE.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_REGBROWSERS.EXE 58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe"C:\Users\Admin\AppData\Local\Temp\58c9131cb7064d0f7ed71ddb4d4401763efc75683874a2f3b9b218d3bbc221b1.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3916