Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2024, 06:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
120 seconds
General
-
Target
f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe
-
Size
92KB
-
MD5
9367db1f6609f05516be7f469715f8c0
-
SHA1
c0adddf0353fc5ab2f0cc3b4b06fb9a056ae4556
-
SHA256
f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880
-
SHA512
a44c2d24792554ed0794ca53f080d36a289c15e196ca9f76af5d19db600140acd30435fd8b06608f9a0b6b4fb831ed625c0f66598fa509d65f72e4c471f25587
-
SSDEEP
1536:DHB0UxMkzOt7HcvJGt5AdHIOWnToIf12ZqTUga8on5o:DhAWJGSCTBf12Z1g1on5
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\DRIVERQUERY.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\MSDT.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\SNDVOL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\SPEECH_ONECORE\COMMON\SPEECHMODELDOWNLOAD.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\TAKEOWN.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\TAR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\WRITE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\CHKNTFS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\DFRGUI.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\INSTALLSHIELD\SETUP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\SDCHANGE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\SVCHOST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\EDPNOTIFY.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\LOGMAN.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\ROUTE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\TYPEPERF.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\ARP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\PACKAGEDCWALAUNCHER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\PROQUOTA.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\WAITFOR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\RMCLIENT.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\TRACERT.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\UNREGMP2.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\CAMERASETTINGSUIHOST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\EXPLORER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\OPENFILES.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\PRINTUI.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\REGEDT32.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\UPNPCONT.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\THUMBNAILEXTRACTIONHOST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\CURL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\EHSTORAUTHN.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\IEUNATT.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\NETPLWIZ.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\RUNONCE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\SETUPUGC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\USERACCOUNTBROKER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\CHARMAP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\DISKPERF.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\DPISCALING.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\NETIOUGC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\REGISTER-CIMPROVIDER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\DPNSVR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\EFSUI.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\PCAUI.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\TASKLIST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\CMMON32.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\FONTDRVHOST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\GETMAC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPDCT.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\XCOPY.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\HH.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\LAUNCHTM.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\SECINIT.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\TOKENBROKERCOOKIES.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\WOWREG32.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\REGINI.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\BITSADMIN.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\CERTUTIL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\CIPHER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\NETBTUGC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\RDPSAPROXY.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\ATBROKER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SysWOW64\CACLS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.DESKTOPAPPINSTALLER_1.0.30251.0_X64__8WEKYB3D8BBWE\APPINSTALLERPYTHONREDIRECTOR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.371\GOOGLEUPDATECORE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVA.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\POLICYTOOL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\CLIENT\APPVLP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\POWERPNT.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\DBCICONS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.GETSTARTED_8.2.22942.0_X64__8WEKYB3D8BBWE\FMUI\FMUI.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTOFFICEHUB_18.1903.1152.0_X64__8WEKYB3D8BBWE\LOCALBRIDGE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\DOTNET\SHARED\MICROSOFT.NETCORE.APP\7.0.16\CREATEDUMP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\ORBD.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\EXCEL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.SKYPEAPP_14.53.77.0_X64__KZF8QXF38ZG5C\SKYPEBRIDGE\SKYPEBRIDGE.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\DOTNET\SHARED\MICROSOFT.NETCORE.APP\6.0.27\CREATEDUMP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ORGCHART.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\APPSHARINGHOOKCONTROLLER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVA-RMI.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.NETFX40.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\EXCELCNV.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\FLTLDR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\LYNCICON.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\MSINFO32.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KINIT.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WEBMEDIAEXTENSIONS_1.0.20875.0_X64__8WEKYB3D8BBWE\MICROSOFT.WEBMEDIAEXTENSIONS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSCOMMUNICATIONSAPPS_16005.11629.20316.0_X64__8WEKYB3D8BBWE\HXTSR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\INK\PIPANEL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\WORDICON.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PRIVATE_BROWSING.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOXGAMINGOVERLAY_2.34.28001.0_X64__8WEKYB3D8BBWE\GAMEBAR.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS NT\ACCESSORIES\WORDPAD.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVACPL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KTAB.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOIA.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\BROWSER\WCCHROMEEXTN\WCCHROMENATIVEMESSAGINGHOST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\INSTALL\{1D4B5551-822C-42C0-B673-53AB80587853}\CHROME_INSTALLER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\MSEDGEWEBVIEW2.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\TNAMESERV.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOXSPEECHTOTEXTOVERLAY_1.17.29001.0_X64__8WEKYB3D8BBWE\SPEECHTOTEXTOVERLAY64-RETAIL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ADELRCP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAFXPACKAGER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\SERVERTOOL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH_TARGET_85250\JAVAWS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNETWK.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.PEOPLE_10.1902.633.0_X64__8WEKYB3D8BBWE\PEOPLEAPP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WAB.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WALLET_2.4.18324.0_X64__8WEKYB3D8BBWE\MICROSOFT.WALLET.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\EULA.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\MSINFO\MSINFO32.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.371\GOOGLEUPDATECOMREGISTERSHELL64.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\EXTCHECK.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\NATIVE2ASCII.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVACPL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOTD.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.STOREPURCHASEAPP_11811.1001.18.0_X64__8WEKYB3D8BBWE\STOREEXPERIENCEHOST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\NOTIFICATION_HELPER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JABSWITCH.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KINIT.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KLIST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SKYPESRV\SKYPESERVER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\DW\DWTRIG20.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PINGSENDER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFT3DVIEWER_6.1908.2042.0_X64__8WEKYB3D8BBWE\3DVIEWER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\NETFXSBS10.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\IEEXEC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\ADDINPROCESS32.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\VBC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSBUILD.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADDINPROCESS32_B77A5C561934E089_10.0.19041.1_NONE_3700BDC08C446A5C\ADDINPROCESS32.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DW20.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSBUILD.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_COMPILER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\IEEXEC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\ADDINUTIL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_REGIIS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ADDINUTIL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CASPOL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_CASPOL_B03F5F7F11D50A3A_10.0.19041.1_NONE_E51212A36C631D23\CASPOL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CVTRES.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ADDINUTIL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\JSC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\NOTEPAD.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.BIOENROLLMENT_CW5N1H2TXYEWY\BIOENROLLMENTHOST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\SCREENCLIPPING\SCREENCLIPPINGHOST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADDINUTIL_B77A5C561934E089_4.0.15805.0_NONE_FCD173BC1B434B81\ADDINUTIL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\EDMGEN.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NGEN.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADDINPROCESS32_B77A5C561934E089_4.0.15805.0_NONE_FAEE98A3C711FAE7\ADDINPROCESS32.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_WP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\WSATCONFIG.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\APPLAUNCH.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\READER_SL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WSATCONFIG.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_REGBROWSERS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_COMPILER_B03F5F7F11D50A3A_4.0.15805.0_NONE_73CC8B3E43BA1056\ASPNET_COMPILER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\WSATCONFIG\V4.0_4.0.0.0__B03F5F7F11D50A3A\WSATCONFIG.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\JSC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SYSMON.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_REGSQL_B03F5F7F11D50A3A_4.0.15805.0_NONE_AADF84CDA75DA02D\ASPNET_REGSQL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\DFSVC\2.0.0.0__B03F5F7F11D50A3A\DFSVC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_REGIIS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\COMSVCCONFIG.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_CASPOL_B03F5F7F11D50A3A_4.0.15805.0_NONE_C6DC1994DB088235\CASPOL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_WP.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\WSATCONFIG.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.ACCOUNTSCONTROL_CW5N1H2TXYEWY\ACCOUNTSCONTROLHOST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\SHELLEXPERIENCEHOST_CW5N1H2TXYEWY\SHELLEXPERIENCEHOST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_64\MSBUILD\3.5.0.0__B03F5F7F11D50A3A\MSBUILD.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\EXPLORER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\LOGTRANSPORT2.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\COMSVCCONFIG\V4.0_4.0.0.0__B03F5F7F11D50A3A\COMSVCCONFIG.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMCONFIGINSTALLER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_COMPILER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DATASVCUTIL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_REGSQL.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\VBC.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMSVCHOST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ADDINPROCESS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\ADDINPROCESS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_REGBROWSERS.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SERVICING\TRUSTEDINSTALLER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.APPRESOLVERUX_CW5N1H2TXYEWY\APPRESOLVERUX.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ACRORD32INFO.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4BITMAPIBROKER.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMSVCHOST.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WPF\XAMLVIEWER\XAMLVIEWER_V0300.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.XBOXGAMECALLABLEUI_CW5N1H2TXYEWY\XBOX.TCUI.EXE f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe"C:\Users\Admin\AppData\Local\Temp\f0a4fc872f82fa8ec3764a9d1dd77e15911fa85897f11524adfdedf807c0a880N.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2472