Analysis
-
max time kernel
16s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 02:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe
-
Size
92KB
-
MD5
5f5dd4299c3790385f17665f27e6479f
-
SHA1
deeabdce29a7fc06bc57b0b3b02dc06c1cf868e5
-
SHA256
e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef
-
SHA512
7ca3a10c04f55e6f52bf3b1f6e3f72ea48669bcc8cedc0d3f032b6952416417a27f82da46a1bc53497e6a8c6074e887e92322849cf3d755a3cf55435fc6856db
-
SSDEEP
1536:DHB0UxMkzOt7HcvJGt5AdHIOWnToIf12ZqTUgae8o80o:DhAWJGSCTBf12Z1gL8o80
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\MIGAUTOPLAY.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\RELOG.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\SEARCHINDEXER.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\WUAPP.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\PRINT.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\AUTOFMT.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\CTTUNE.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\HH.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\SYNCHOST.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\SYSTEMPROPERTIESPROTECTION.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\RUNLEGACYCPLELEVATED.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\XCOPY.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\TCPSVCS.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\MOFCOMP.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\CHARMAP.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\IEUNATT.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\LABEL.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\EXPAND.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\FINDSTR.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\PING.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\HDWWIZ.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\XWIZARD.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\DVDUPGRD.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\DXDIAG.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\MOUNTVOL.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\SECEDIT.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\RASDIAL.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\RUNDLL32.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\WBEM\WMIPRVSE.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\CHOICE.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\POWERCFG.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\RDRLEAKDIAG.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\DISM.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\TPMINIT.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\CTTUNESVR.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\NAPSTAT.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\EXTRAC32.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\NDADMIN.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\TZUTIL.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\DIANTZ.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\DPNSVR.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\OSK.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\AUTOFMT.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\CMDKEY.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\PKGMGR.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\RESMON.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\REPLACE.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\ATTRIB.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\MRINFO.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\DISKRAID.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\GRPCONV.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\LOGMAN.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\RPCPING.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP10\IMJPUEXC.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\INSTALLSHIELD\_ISDEL.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\RUNDLL32.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\WECUTIL.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\NOTEPAD.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\DCOMCNFG.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\REAGENTC.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\REGSVR32.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\CIPHER.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SYSWOW64\INSTNM.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SysWOW64\DNSCACHEUGC.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7ZG.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\EXTCHECK.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\ORBD.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\MAHJONG\MAHJONG.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\EXCEL.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PINGSENDER.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPENC.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATEONDEMAND.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSACCESS.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\RMIC.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE AIR\VERSIONS\1.0\ADOBE AIR APPLICATION INSTALLER.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DOWNLOAD\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\CHROME_INSTALLER.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\FLICKLEARNINGWIZARD.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KLIST.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\ORBD.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\FREECELL\FREECELL.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSQRY32.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\OUTLOOK.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JAVAWS.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UPDATER.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ACRORD32INFO.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\OARPMANY.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\NAMECONTROLSERVER.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IELOWUTIL.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\SPIDERSOLITAIRE\SPIDERSOLITAIRE.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\UNINSTALL.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\WORDCONV.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JSADEBUGD.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVAWS.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\MSTORE.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\SERVERTOOL.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JAVA.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\DW\DWTRIG20.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPLAYER.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPRPH.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\UNPACK200.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\PURBLE PLACE\PURBLEPLACE.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\SMART TAG\SMARTTAGINSTALL.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPCONFIG.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNETWK.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\SETUP FILES\{AC76BA86-7AD7-1033-7B44-A90000000001}\SETUP.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\FLTLDR.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\SOURCE ENGINE\OSE.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\EXTEXPORT.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\VPREVIEW.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS PHOTO VIEWER\IMAGINGDEVICES.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JAVAW.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\EXCELCNV.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\ONENOTE.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZFM.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\OFFICE14\MSOXMLED.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\106.0.5249.119\INSTALLER\SETUP.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JVISUALVM.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\SOLITAIRE\SOLITAIRE.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WABMIG.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAW.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\RMID.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JP2LAUNCHER.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\KTAB.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\CLVIEW.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\SETLANG.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JHAT.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JPS.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\REGSVCS.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-PDM_31BF3856AD364E35_8.0.7600.16385_NONE_6425238B793EE910\PDMSETUP.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..ESSAGINGCORESERVICE_31BF3856AD364E35_6.1.7601.17514_NONE_412FCD2AFECDC412\MQBKUP.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WINLOGON-TOOLS_31BF3856AD364E35_6.1.7600.16385_NONE_F0686B7CA6ACDE00\MPNOTIFY.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_SUBSYSTEM-FOR-UNIX-BASED-APPLICATIONS_31BF3856AD364E35_6.1.7601.17514_NONE_D20E5D35068F261A\POSIX.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\COMSVCCONFIG.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..ATIBILITY-ASSISTANT_31BF3856AD364E35_6.1.7600.16385_NONE_8FBB77BB3CD808D1\PCALUA.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-COM-DTC-RUNTIME_31BF3856AD364E35_6.1.7600.16385_NONE_7547F48C79B40229\MSDTC.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..-ODBC-ADMINISTRATOR_31BF3856AD364E35_6.1.7600.16385_NONE_A044D905576812D4\ODBCAD32.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..OXGAMES-PURBLEPLACE_31BF3856AD364E35_6.1.7600.16385_NONE_622070221822EB39\PURBLEPLACE.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_6.1.7601.17514_NONE_90ECF919657DACF4\NETSTAT.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\INSTALLUTIL.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..IME-EASHARED-IMEPAD_31BF3856AD364E35_6.1.7601.17514_NONE_98B24799B5D08C05\IMEPADSV.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DPAPI-KEYS_31BF3856AD364E35_6.1.7600.16385_NONE_D9C7C4A2E721DA7E\DPAPIMIG.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAFOUNDATION_31BF3856AD364E35_6.1.7601.17514_NONE_FA8534AB236134C4\MFPMP.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NSLOOKUP_31BF3856AD364E35_6.1.7601.17514_NONE_29A6795F7D1218C6\NSLOOKUP.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-C..MPLUS-ADMIN-COMREPL_31BF3856AD364E35_6.1.7600.16385_NONE_45FE6FE8A9201E55\COMREPL.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EHOME-EHPRIVJOB_31BF3856AD364E35_6.1.7601.17514_NONE_53393627486AE37B\EHPRIVJOB.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WRP-INTEGRITY-CLIENT_31BF3856AD364E35_6.1.7600.16385_NONE_8733BEE404F7386C\SFC.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\EHOME\EHMSAS.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CSRSS_31BF3856AD364E35_6.1.7600.16385_NONE_B4D8D57EFDC6B4F3\CSRSS.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DEVICEPAIRINGAPP_31BF3856AD364E35_6.1.7600.16385_NONE_CB9353551BBD8ED8\DEVICEPAIRINGWIZARD.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-F..TEMCOMPAREUTILITIES_31BF3856AD364E35_6.1.7600.16385_NONE_5CBB962A4F0D58C1\COMP.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..ESSAGINGCORESERVICE_31BF3856AD364E35_6.1.7601.17514_NONE_412FCD2AFECDC412\MQSVC.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_6.1.7601.17514_NONE_42D65ED50FA3C682\QAPPSRV.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-VERCLSID_31BF3856AD364E35_6.1.7600.16385_NONE_17DBC2DD2D2552C7\VERCLSID.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-ASPNET_WP_EXE_B03F5F7F11D50A3A_6.1.7601.17514_NONE_5197FBF234706563\ASPNET_WP.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-CLR_ILASM_EXE_B03F5F7F11D50A3A_6.1.7601.17514_NONE_8FBF4B0735F59A32\ILASM.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-REGISTRY-EDITOR_31BF3856AD364E35_6.1.7600.16385_NONE_5023A70BF589AD3E\REGEDT32.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ADDINPROCESS.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\REGASM.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CHKDSK_31BF3856AD364E35_6.1.7600.16385_NONE_1DDB4B87A6618437\CHKDSK.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-COM-COMPLUS-UI_31BF3856AD364E35_6.1.7600.16385_NONE_0C9CB55C61E99805\DCOMCNFG.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..-JAPANESE-UTILITIES_31BF3856AD364E35_6.1.7601.17514_NONE_4B57445488BA33FD\IMJPUEX.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DEFRAG-CMDLINE_31BF3856AD364E35_6.1.7600.16385_NONE_2370C162E00680C3\DEFRAG.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PNPUI_31BF3856AD364E35_6.1.7600.16385_NONE_BACC830144FA7791\DINOTIFY.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..NPUTPERSONALIZATION_31BF3856AD364E35_6.1.7600.16385_NONE_9BA1049CE0053BEF\SHAPECOLLECTOR.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\EHOME\WOW\EHEXTHOST32.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\ADDINPROCESS.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DFSVC.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CSC.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..LIFIED-CHINESE-CORE_31BF3856AD364E35_6.1.7601.17514_NONE_763763505E93084B\IMSCPROP.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-SETUP_31BF3856AD364E35_6.1.7601.17514_NONE_0C19CEF0ED2A642E\SETUP_WM.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-COM-SURROGATE_31BF3856AD364E35_6.1.7600.16385_NONE_A018E05D0D33081D\DLLHST3G.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\INSTALLER\{90140000-0011-0000-0000-0000000FF1CE}\CAGICON.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SERVICEMODELREG.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DATASVCUTIL.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\EXPLORER.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..EOPTIONALCOMPONENTS_31BF3856AD364E35_8.0.7601.17514_NONE_7A9A2F07E4E23A48\CONFIGUREIEOPTIONALCOMPONENTS.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_REGSQL.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EUDCEDIT_31BF3856AD364E35_6.1.7601.17514_NONE_B7BE8A14D61DB17A\EUDCEDIT.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MAGNIFY_31BF3856AD364E35_6.1.7600.16385_NONE_CA22C913B260E66A\MAGNIFY.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SERVICINGSTACK_31BF3856AD364E35_6.1.7601.17514_NONE_678566B7DDEA04A5\PKGMGR.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\SPEECH\COMMON\SAPISVR.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-C..UTERMANAGERLAUNCHER_31BF3856AD364E35_6.1.7600.16385_NONE_EA0A643B0E032C19\COMPMGMTLAUNCHER.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..X-DIRECTXDIAGNOSTIC_31BF3856AD364E35_6.1.7601.17514_NONE_81E99DA174638311\DXDIAG.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-IEXPRESS_31BF3856AD364E35_11.2.9600.16428_NONE_46D2EFEF53C02386\IEXPRESS.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RASAUTODIAL_31BF3856AD364E35_6.1.7600.16385_NONE_6BCEF05D7F04260A\RASAUTOU.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..ESTARTUP-FVERECOVER_31BF3856AD364E35_6.1.7600.16385_NONE_AB0552BCEECA5A61\BDEUNLOCKWIZARD.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..CSENGINE-NATIVEHOST_31BF3856AD364E35_6.1.7600.16385_NONE_761AD65676427BD9\SDIAGNHOST.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NARRATOR-NONMSIL_31BF3856AD364E35_6.1.7601.17514_NONE_8B63C5E0DB87FDE8\NARRATOR.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSBUILD.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_STATE.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MOUNTVOL_31BF3856AD364E35_6.1.7600.16385_NONE_0E4E6B146B2452A9\MOUNTVOL.EXE e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe"C:\Users\Admin\AppData\Local\Temp\e10ae206d9888ee5ef687a1290dcd1dc04ed09a1779d5126650cd5107d2b75ef.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2484