Malware Analysis Report

2025-03-15 04:21

Sample ID 241026-alj9maxhkj
Target af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN
SHA256 af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78f
Tags
discovery evasion persistence spyware stealer
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78f

Threat Level: Likely malicious

The file af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN was found to be: Likely malicious.

Malicious Activity Summary

discovery evasion persistence spyware stealer

Disables Task Manager via registry modification

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Adds Run key to start application

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-26 00:17

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-26 00:17

Reported

2024-10-26 00:20

Platform

win7-20240903-en

Max time kernel

110s

Max time network

76s

Command Line

"C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe"

Signatures

Disables Task Manager via registry modification

evasion

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\locator.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer.exe = "C:\\Windows\\System\\explorer.exe" C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\System\ = "C:\\Windows\\explorer.exe.vbs" C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\RCXAC3F.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXAE1B.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\RCXAB33.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\RCXAB86.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\RCXADD4.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\en-US\Sidebar.exe.mui.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\ja-JP\RCXB292.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RCXAAF3.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXAEE1.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RCXB1EA.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Internet Explorer\en-US\RCXA90C.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\RCXB098.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\fr-FR\RCXB25C.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\RCXAC8F.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\RCXAFFA.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\de-DE\RCXB00D.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Media Player\it-IT\wmlaunch.exe.mui.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\RCXB0FF.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\RCXABED.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\RCXADA9.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\de-DE\RCXB236.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\RCXABAC.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\RCXAB9B.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Media Player\fr-FR\WMPDMC.exe.mui.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Media Player\it-IT\wmplayer.exe.mui C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\RCXB112.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RCXAAB9.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\RCXB054.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RCXAA8C.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\en-US\RCXAFA7.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Media Player\wmpenc.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\RCXAC02.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Mail\wabmig.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\RCXB124.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\RCXB14D.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXAE1A.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\it-IT\RCXAFD1.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\it-IT\RCXB20F.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\RCXABC7.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\RCXAB0A.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Internet Explorer\en-US\ieinstal.exe.mui C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RCXAAB6.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Mail\WinMail.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\wmplayer.exe.mui.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\RCXAC42.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\RCXAB70.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXAF73.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\RCXB068.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\RCXB07F.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Media Player\it-IT\WMPDMC.exe.mui C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\RCXB61D.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\WsatConfig.ni.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\2bd538d545e15452202ef3b41080e2ce\RCXB6B8.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281#\df459c0a2762c33e0699703f186b1751\RCXB6E0.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Narrator\6.1.0.0__31bf3856ad364e35\Narrator.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\RCXB641.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\RCXB678.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281#\df459c0a2762c33e0699703f186b1751\RCXB6CE.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\RCXB582.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\RCXB5E8.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\RCXB654.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\Narrator.ni.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\PresentationFontCache.ni.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\RCXB679.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\dfsvc\261c09179eae03d67c9b6f3e70b603bd\RCXB6CC.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\explorer.exe.me C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\dfsvc\261c09179eae03d67c9b6f3e70b603bd\RCXB6CB.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\RCXB4AB.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\ehexthost\6.1.0.0__31bf3856ad364e35\RCXB4BC.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\RCXB5D4.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\RCXB497.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\RCXB56F.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\RCXB62F.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost\e88db1688b08fbb889b0b9d4b1a51493\RCXB704.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\RCXB4AC.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\loadmxf.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\RCXB5E5.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\loadmxf.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\RCXB5D5.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\RCXB630.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\2bd538d545e15452202ef3b41080e2ce\RCXB6B9.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\RCXB487.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\RCXB4BF.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\dfsvc.ni.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost\e88db1688b08fbb889b0b9d4b1a51493\SMSvcHost.ni.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\MSBuild.ni.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\2bd538d545e15452202ef3b41080e2ce\RCXB6BA.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\dfsvc\261c09179eae03d67c9b6f3e70b603bd\RCXB6CD.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\WsatConfig\537950d9c71af966e1d8c9deb550f842\WsatConfig.ni.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\1bc1ee3c3aa45d28dcf4657bceb2fcb4\RCXB666.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\MSBuild\b93c627ec2e15c2675bcc81edafb10be\RCXB6E1.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\MSBuild\b93c627ec2e15c2675bcc81edafb10be\RCXB6E2.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\ehexthost\6.1.0.0__31bf3856ad364e35\ehexthost.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\ehexthost\6.1.0.0__31bf3856ad364e35\ehexthost.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\dfsvc\261c09179eae03d67c9b6f3e70b603bd\dfsvc.ni.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\explorer.exe.vbs C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\WsatConfig\537950d9c71af966e1d8c9deb550f842\RCXB736.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\RCXB4AA.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\RCXB570.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\RCXB583.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\RCXB5F9.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\RCXB653.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\c899de3549784161aa66610d5735e4f0\RCXB5FB.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\2bd538d545e15452202ef3b41080e2ce\ComSvcConfig.ni.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost\e88db1688b08fbb889b0b9d4b1a51493\RCXB705.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\WsatConfig\537950d9c71af966e1d8c9deb550f842\RCXB735.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Narrator\6.1.0.0__31bf3856ad364e35\Narrator.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\locator.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe

"C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe"

C:\Users\Admin\AppData\Local\Temp\locator.exe

C:\Users\Admin\AppData\Local\Temp\\locator.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.cmyip.com udp
US 8.8.8.8:53 pop.mail.ru udp
RU 217.69.139.74:110 pop.mail.ru tcp
US 8.8.8.8:53 smtp.mail.ru udp
RU 217.69.139.160:587 smtp.mail.ru tcp
US 8.8.8.8:53 www.cmyip.com udp
US 8.8.8.8:53 pop.mail.ru udp
RU 217.69.139.74:110 pop.mail.ru tcp
US 8.8.8.8:53 smtp.mail.ru udp
RU 217.69.139.160:587 smtp.mail.ru tcp

Files

C:\Users\Admin\AppData\Local\Temp\locator.exe

MD5 4eb484338fb62ed86a86d28013bff9fd
SHA1 50a8d6b264031d2cbd6b63f236e73453a465b416
SHA256 7a78c314dc2ab47aeca9994c85364fa357bdb5d7c9a2a5cb08c0b31d5264f2f0
SHA512 3a56217dd25042f0094a62f13fbb87146333172bcd0bd10772b859d4d56ecea4636a0b992f9599f00695fa5fdac20ce918f9d2bd9f42252d28668898f0262f52

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\RCXA890.tmp

MD5 23ebbbf2f339ebf6bb8baaea58522990
SHA1 a4e4f29e79cf09e602055af6fcdaecb380c0b06c
SHA256 af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78f
SHA512 2aa977c50133ccb7c6d5ffd32a52a8f0aebc8ca47954cde53c4675589acad474f85603635d6fcef2d6116a3b44afcb8ed111baa76682850f907069e847162d21

C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.exe

MD5 eebc0edbf3f9012f7bc5dec44552979b
SHA1 68c9ba6ac81dd9e19e8622b56c2327287d1c40c6
SHA256 65948c49711acc0bdbe40481d741c2b7061e985c95a4242d2d109b9f30a79b5f
SHA512 ebabc3c4fc656cc9285fdd3954ce111df27187e5e9f83e784b7adc9663300cc08e7518b9d2bd91659936dd9f3c9da83f16fa4e06609453a6db412aed9125aefd

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe.exe

MD5 95994b78e348c75b8cd4546c035b283b
SHA1 7cd0ba0ced280d1ce02f95576a691889c1fbf281
SHA256 b21f2fa66ce28ac51bc0d2bde3831445fb50a760e233d7070598ded21d41d1a9
SHA512 51b5b4e2be5b0825903c769d82d373b8b554492903e5072df95d4493230cb3becf4335ca7ce1ef22e42db1c851b6a5875daaea7118b65c2c8f645f84a8f71b95

C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\RCXAB88.tmp

MD5 6e900e866849d6d6b544d2051c5d2c41
SHA1 86dda55e77d608bc5c11f55f3116fbeb801c501e
SHA256 e95789bc092b5b4a3df45410b0a62576b2d48e358af4dcf90171e029d8af2d85
SHA512 f385f4fce59d60eba553c110048346bde7535248a67ce1b507b35a37f09164042469e845452af2ac16d249ca41301a7823b7fd69ddc3d090425dec89e1ede56c

C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\mip.exe.mui.exe

MD5 ab34c4cda0103b084949dd96c9d98f5e
SHA1 a51334af72d99c88676ab243de2618c04392e376
SHA256 262659405694d69f8779f753aafce050867ed2f1cd6d533da685dacb7c35e19d
SHA512 254afc21d117ded28fcadc5a2e08cd43b847200f23123411e6d70922045308e8a7fb8f6002e245641d0966677d95676b83a35d3110471fcdf0e974de72cc66f5

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\RCXABC7.tmp

MD5 4b5218c93178ed3914cc85c96a983bbc
SHA1 dfc322770af749f4d4503513469df064d0ee0277
SHA256 2388a2e8de256b221edbaa685d64a3badee7714685fb005729591dc9d278b0bd
SHA512 e0bb7c79ad2eb6effd2c26ad356077e3d77839baa728a8707d8cea1923e40d33912389bec9003e9eb7f3fbb50858030f85f21a4e1aa15a956214b5a5102d4558

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\RCXAC2B.tmp

MD5 ed2d93fdb461de2bcae226d44695a01c
SHA1 e8d5dbf03f2c14a6cf735c2f483d1d134221f15b
SHA256 a44472ace9e496cbb53284bdcd2fdca26b94c7bb29f1c069e5bdbaa05d0a9821
SHA512 a934e3973f76a5aff076f6f587491e91ea2c9a79433484d16c9df5897f1d9e5bc4d2220bb0e5ca232dace3adfc3e72315807983a91b9af6685ddc15f4ae0c834

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\RCXAC68.tmp

MD5 1b653b2dafcbe5ff231ee3202bdf7a1a
SHA1 f792cdec7c87378d6a73b4a8bfd63c5487310db6
SHA256 40c6e36816116f48ca6e0eb17af2550fefef7ddc6fdd3f39f79647d17d062d87
SHA512 022a316e2ca7d9d8e7a0f2297e7e008de86fd3df1797dd0319dfd9fed91eec4a2f26c35ddd6253cbcd2ccb218b62538fff0ec5af21a38d11769d950435738737

C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe.exe

MD5 2fe8301bb6ee27035b3cc35506e89db3
SHA1 a05724215c2a21694bcb32c46c302738467fc157
SHA256 6600ac4a08ae4f027c39fd326919a4b3691d73b17f158d9f37c39bf640a63fff
SHA512 12828557ed4b8eac9d4a8e365728858d449d947a56c348e4ce6b5f9f2665588eeeab71738cdb6abca2542986f687a65343e7182a98d76fbdb4cd3150531751b1

C:\Program Files (x86)\Google\Update\1.3.36.151\RCXACD9.tmp

MD5 16b9ff387800bf8b2b4eec92281b3d36
SHA1 4d5e1ee2f1f8c97e8fe408dff26191d3ca7eb21e
SHA256 6e14781859ac4bb11b7f6cddc2c73f6126a69ca27c7568f7dffcb52e5353b231
SHA512 fe4ea2a5bea088513e99e2e7e3c6cad281ef8d91f4cf9fb91587f9e8f9e51e1bfd20f58edba14b96a6de62babd27dd72df4caa4e2a15308b05610f0e510e522b

C:\Program Files (x86)\Microsoft Office\Office14\RCXAE1A.tmp

MD5 e2cf636d1b7ffda8e6fde26eb0ffd168
SHA1 01d6a900e2d1727cfdb1abd486d767139a27f3dd
SHA256 5cdc7f212563f15bb3df5cff7ba33663a51fde61c5b437ca27b930c71c622673
SHA512 a8d2a282e83854f5811b9a3b0b4cca165185792f0e3cce4e9aed89a9d0fa999f85552fa40d815cce592b0064f202c541be6da8dd49da9546ad2d63462ab99d86

C:\Program Files (x86)\Microsoft Office\Office14\RCXAEA1.tmp

MD5 4a03367a05d9fa8952a02601872dcf1b
SHA1 de742912008e72deefc9eadd41b432d0d3274a0d
SHA256 b64fede69c58bf876a263842a31f47dd18c1876fe99034295bbaf9281e1a38b1
SHA512 f7c511d31be80fb70b74bc5d3d32d8db5e34472348a9dbc5f44da8fbfac8a57ea456c0a2ef5ae4d33a4eba65c79c87d1de2f34ce410b9146f7cb9a1d8b153f3c

C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui.exe

MD5 94cb15e43bf9642a03dba5011f059349
SHA1 3337bd534443afc0ecb901c5cae14e3b2599e27d
SHA256 090dcbefd177ea9c90a31759469edbc0be7e88bb8c933c6a7b85ea12c6257e60
SHA512 517b52384692e9e95d41c33bfaf5e000964933668f277653ad96228f88dd3e5a44e329e308fe72fbda14e6af1ecb19890a59c281a400f97ddfe5e6a528d8a800

C:\Program Files (x86)\Windows Mail\it-IT\RCXAFD0.tmp

MD5 a9306325388aacf51b99770c434ae3e0
SHA1 e4847a06fab1f98e593ff837e3e224f654e9d34d
SHA256 f622a809d3f94fd42f1b5b90b4e5fa9df3d6e69fdb2b6b54d8ea8a4825552e44
SHA512 07bc30a12a3eeace3e17e7f86a45787c9124bd03e9e8ea343ad20a38c23aa12c3049c16a526da20e0d813747b9a8fea95d740f8aa26cae107add6a7068e209e4

C:\Program Files (x86)\Windows Media Player\en-US\RCXB03B.tmp

MD5 87bbde7cb3796017223dd1fd7ada78d9
SHA1 0384d7552828b5caf3f5a22cfd494c1aa3cb31fc
SHA256 3aba670c0af55c25b571cc74c975eb251319be285495d5fbcbada8cb72f06ace
SHA512 b7733538f3c9f6203b2306db69c5dfd4cbb4b26128512ebba8dd140b0864b95b312956004128e29c248b24e18a60eec6232f886d16e99ac3a1aef031d1879d79

C:\Program Files (x86)\Windows Media Player\fr-FR\RCXB097.tmp

MD5 f995f99b6d5135daf0de4b693f3bcc86
SHA1 3c14058482d968915bb2c9438c736af2bb1246ae
SHA256 403e595ff457562d0521380d6ec1b5ee24b950001ce01f4118fd7a19a0fbdf11
SHA512 d0e0328c3e1c5a05942b4546a36025da415c844885ae1fb165bc623df38e228144221ba1145974ab1456a75edeccbc306feab3503ce28248f17bc5e8d1ef6836

C:\Program Files (x86)\Windows Media Player\it-IT\RCXB0C0.tmp

MD5 983d847e614904f2b00b08e1d8be066f
SHA1 2d82f55c5e3c30385cbb8bbf19b453bd4ef9ac68
SHA256 a87ba678a70a1268af3e9de26ae085c531849d8e3eb29a5c4812cd501d4e2259
SHA512 656a7e10da4e5d9413311e6a5aca44fac0b22dfff0c85a1687f1a5311401a6cc34e9ae0ee46c527ac8b8db322b5e9294b53b2d3ea7b328e18ebc8615526dfd9b

C:\Program Files (x86)\Windows Media Player\ja-JP\RCXB0E8.tmp

MD5 476341f2acc5e2f931415262306322ca
SHA1 78ac54dfa870f79e126f7851e88a8827448039aa
SHA256 c572c8d35d591a82757e0c1bb5fe478cff6e4a15b56851013f0a276ece23fb07
SHA512 8d95c628e15f556349c03527e4b00957962e25df6865ae45d09dcc0ec6e113ec104c29c6fa41476c0fa2fc30295ec3e1123449fbeb862cae83eb639cac649e25

C:\Program Files (x86)\Windows Media Player\ja-JP\RCXB0ED.tmp

MD5 c3802745144e62e4ab77977f376d9a87
SHA1 b7e181ddce532352862248fb0fe98a98ff791549
SHA256 46d150aca8b1328af44f143e6d217aa6d643ef4953350cf0bbd4963e9f007d2d
SHA512 07a5265eccb2ee2e07b80e014ede16ab1c3c62130b74c285a958cbbbd8d9b05c559a170a0c3716e7d6fa9e3f3e58527119cdda14294b6c4b02afe231a3ac84c3

C:\Program Files (x86)\Windows Media Player\RCXB0FE.tmp

MD5 cd466ea523183c75afe4264be5ad7966
SHA1 b2ecd838935b5e70c4f1814f513ddb6cddc8a3ab
SHA256 dfdbcf394be1894d1fcedc5302e59dfd0a6bf9d13bd2263d95c818c605d34171
SHA512 19460504bf4b1c67bd3f4c86d5df427bc050c112612c9de48477001bc5aad2827524690897352adf17796c8e6fe8e2003e1091a1784bd3cecd97fc7b1eb6d33c

C:\Program Files (x86)\Windows Media Player\RCXB113.tmp

MD5 b1a9feec391e638f4e9927a14b11bf5e
SHA1 ffe6e43929d06efec4203e336ce6c20cf2c646c4
SHA256 fd85406193772e9987c07fc9ecb7e2b0706ad2a79b4e38931d00fe5bbb064296
SHA512 2c5267c4ee4acb76e47c54ac82e723f48065dfcd50470626921f6245eec14fc9003d8693e0ddd609591831f8d6657595f14119702edd2443efb4d4c0d8e94292

C:\Program Files (x86)\Windows Media Player\RCXB139.tmp

MD5 c5c01d81a6b89db453be393f0f6b1d78
SHA1 d8d0b8c8fd07da31fe2393e9ef895fe6a86b96c3
SHA256 91a590769a7f59f597f7d0bf6735e743f163db25514f23f696b46751e15e7fbc
SHA512 b393ead6057cd6676e53c672bd76f84ae45e749f8a812c895ba747508fe9417a11cb51df57374baa5583f571dc81d149b2d55ef984aa697f854681c4ba892a23

C:\Program Files (x86)\Windows NT\Accessories\de-DE\RCXB15F.tmp

MD5 f84c2d6632ee540143f655e120d893dd
SHA1 dd6bde1e8924b73a1f4c0652db622e737018dcd2
SHA256 68148014066b237ceabc436501e828c73b5cc049d52c22ead19f8fda7b085fb8
SHA512 8c0b4735a3428ef231de158e79208373ff8bec8c625cee7b126c607ba74a37b5abab564eb6888cc0eb79a2eedea1be63fac9c9553fa1c97417a7af448257c620

C:\Program Files (x86)\Windows Photo Viewer\de-DE\RCXB1B1.tmp

MD5 49ea5d9c99da0eb432610eb80b2becfe
SHA1 37d2ba6e2e6ec10c27285aa07cda764df47e4760
SHA256 aa0c13aa41b4719cb7a19214f09ba16aff06386ef01530cbf47cec549cf62679
SHA512 9859db661867ad143368fb6aad5c08bd86200f265e4b63e4b2bea5cd03f472c43fdbc2b08d00449caac0f919890101e5b249a9c4edc66690c1a51477efbcfd86

C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui.exe

MD5 692650863518aceb71ac6eb5e273437a
SHA1 15670d391083c10b1a523c86d5d2929d28741332
SHA256 b1e857d77550e16609b936a24f644bb22c71626221d1364cd1b50a57daff3b74
SHA512 fe3c088b7259422d5b160f4817d665b8879b379dc3d059f0b61e8da53eb43ea17451708b45cc22f5aeafbacb311c832a6072da0576a491f8a42b067938f0ea34

C:\Program Files (x86)\Windows Photo Viewer\it-IT\RCXB210.tmp

MD5 0cb7fcc66acc4c743ac21c7aa9172763
SHA1 18a4176d4c7e15af5f18f658dee26387c4e5b6d2
SHA256 ea4acada4b4b278f60e717e561cb08d79e450da0472eae3d13c580b391acb1a2
SHA512 feee4c77a4ed5e6ecd82cbeee2b72228ec0a8c1e1457b973b0506b4e2ad9940e1e3e980979770213de591143d460ad5013dc536b733e0d4466e858f0a37267ec

C:\Program Files (x86)\Windows Sidebar\de-DE\RCXB234.tmp

MD5 0132c49984f6d91b000bec5d05c1fab3
SHA1 38d90946feec9fc22591289ff188562fc7ac65c7
SHA256 2058129a678416a23a9bc1a9e3d8a0e57c366650d491e04dd8c509bc7a9e51ad
SHA512 9e1597ffe07c81723e802b9a3e7626d3a1effb307be88e4b68483b2cddc48a448a337ae9de46285fd9835fcace5464ad3a3c29cd8964749f52619a97a84d81ec

C:\Program Files (x86)\Windows Sidebar\it-IT\RCXB27E.tmp

MD5 7c04aa0e84501fab1c16cc921791bac5
SHA1 460470b3d8d278578b6daae74362977cc5c88dc1
SHA256 22a4c1f4659dba9fda04a309497ba39ebf06e02be77e1c9459cd94c304109f93
SHA512 4bba21562f9b99b7ce05be025e61a336ca03dc38e48452eb05eea585e43ac17734a0e0df86a54fa68ef4a22d8a8e2d0e886abbc73fc7fb5456551c726a1a187a

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\RCXB2EB.tmp

MD5 f2deb65cd4aff96bf5d6545685be103e
SHA1 fcbc637b394e455ee8226612268ff9a6fd492aae
SHA256 d6d384c3868ec40b14002d7a5bbbf5aa36ab4699d7d507d9fde2629c4e660146
SHA512 7b6ab021ea4e43837dd750b1290cffbce4afa8af864233cd4048b4543e12a854596f46cb98ffc6271229552faeb664190eb30ded25c9fa29dd3ba415271e5275

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\RCXB2FC.tmp

MD5 c52c5709e9bb1510b7ce01548914fe7c
SHA1 19b976da3ba0ec9203527abacb84c43e27ef7e1b
SHA256 4dbef8cb2dc176a8cc9db09898801b43fd1209f29dee08f72b90df6fba40dc81
SHA512 849d75571ea325475a6a76447b488db986ee173b5f95190c9dffba8ce6fb2f2d81b528dcc0f4d698afc8e9d8a162e610d8c0b214f811faf83d0fa4fd36205b5a

C:\Users\Admin\AppData\Local\Temp\RCXB347.tmp

MD5 9d4abd5c878abb841faba5c9cbcc17bf
SHA1 9297a617923d510be1be1b7c2aea6e60c982ae95
SHA256 df3e7fa74b3cf3a15612e4a4b0866ee0f268f1c6e1734a166314fb384fffbe4c
SHA512 5f4ee7da6015ff557ebdfa98600c2a18a71e497f439253e8a7df8849291ca914fff97cd2e4520684a1e0e43fdf9e481dbe0f8ff8db6a81e3d3658bd3b04c1d23

\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

MD5 f9f7e1f928779067acd45e8a772e040e
SHA1 7e8f54339c40b907041637e1105bd2d68345b7d7
SHA256 7799fcca65718f266fcb4eac52b7400db1c8fa9385199710c6ee65d695bd6aaf
SHA512 e64c988a8410e1db710f9bdeb7255e80d3b85e07b08655254422b87d3543c3ea29d8ee85de790ea7a1aa3555a36b1c1f1333f3252832d391f40f443f3f40a1e3

C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\RCXB453.tmp

MD5 b3257b55c0b909efa4b232cb069463c7
SHA1 d1b46322306c51e73ee757ae67480c47b16c594f
SHA256 e7b0d92a3720ec6a260f19281fb80888f5fa0f992ff3eeece526c8631919fb21
SHA512 5ef47a1d53effa2981e5a4463634a22d03305ac5f8d903ea1d4e6ed5b3b28d4a9d5fb32f51f8b82f9c37ea332ef2d8dfb1438f98a3a7fbe4c2edfb868c041eb5

C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\RCXB5D3.tmp

MD5 5e0cc281d55e31521fa54a8300f20d9f
SHA1 a1c13ea425df4c131c347536b7476602c2cdf47c
SHA256 4613e91d59b4a5741762b7852c43aeaee68775d3044598cd84314c550aa36db9
SHA512 b9be3064de18964149c1dfa797171c8b9751ed948bfe0d4db7ef16b165dece64fa42dd7eaa3f39e564f5e7c1c21d01abbe7a67129ab2fcc25dc58ddd127b3e4d

C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\RCXB5E5.tmp

MD5 aed1f29cd6a01b87d86809d855ac8a0d
SHA1 c75c41fe4f421db43972d6f42ca4dca8807cf910
SHA256 9f83237c176edaa388632504214982f54ff63bcacdc57dc38f8dfe197df36093
SHA512 545f0d1978860e936228481422a0b5728fe727ab451638dab05fdfa8608b772e29f4b95fcf86358f929669c5687944e7b3a69e002ba1a831e86c3edcb3e6ab3e

C:\Windows\assembly\NativeImages_v4.0.30319_32\WsatConfig\537950d9c71af966e1d8c9deb550f842\RCXB735.tmp

MD5 192d9947409852dc26973d6e8e777e05
SHA1 0751c2055222c4c8307fc0b2a1a2820951bac81a
SHA256 e9965507e63d1dcb58b3670db3b0e03928c8b023ecc111ba890f59d79d0f7258
SHA512 c3c1c4a7c7e885eab7287d22f73d4ce914dc321231be027604ba47d76a5b0fe7d1d741320efa04a4a45920a4189292e6c862f9412720607d0b3438160a122b62

memory/1968-2964-0x0000000013140000-0x0000000013176000-memory.dmp

memory/1968-2965-0x0000000013140000-0x0000000013176000-memory.dmp

memory/1968-2973-0x0000000013140000-0x0000000013176000-memory.dmp

memory/1968-2974-0x0000000013140000-0x0000000013176000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-26 00:17

Reported

2024-10-26 00:20

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe"

Signatures

Disables Task Manager via registry modification

evasion

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\locator.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer.exe = "C:\\Windows\\System\\explorer.exe" C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System\ = "C:\\Windows\\explorer.exe.vbs" C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Windows Media Player\es-ES\RCX9423.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\de-DE\RCX96FC.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX9EF9.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Media Player\it-IT\wmplayer.exe.mui.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\Accessories\en-US\RCXAC93.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\RCXA38B.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\RCXA7D1.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files\Windows Media Player\fr-FR\wmpnetwk.exe.mui C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\RCXAD32.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\RCXA3B0.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\de-DE\RCXA78D.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\it-IT\RCXAD54.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\RCX8C87.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\RCX8CAA.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\RCX8D54.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Internet Explorer\uk-UA\ieinstal.exe.mui.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\wmplayer.exe.mui C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\RCXAB8D.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Media Player\ja-JP\wmplayer.exe.mui C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\RCX8DAF.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Windows Defender\de-DE\RCX9207.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Windows Media Player\fr-FR\RCX947C.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX909D.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\de-DE\RCXA769.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\RCXAB57.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RCXAD1F.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Windows Media Player\es-ES\RCX9411.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\RCX9ED3.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\RCX9166.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ja-JP\RCX95D7.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Windows Media Player\it-IT\RCX94F4.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Windows Defender\uk-UA\RCX9292.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\RCX9ED5.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Windows Media Player\fr-FR\RCX948F.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\RCXAAED.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\RCXAB9E.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\RCXA9B5.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX9013.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\RCX8C99.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Windows Media Player\de-DE\RCX92E7.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Windows Defender\es-ES\RCX922B.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\TabTip32.exe.mui C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\RCX8C98.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\RCX8D7A.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files\Windows Media Player\it-IT\RCX9505.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Program Files\Windows NT\Accessories\fr-FR\wordpad.exe.mui.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\RCXA40A.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\RCXA7AE.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\RCXB5CF.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\RCXB62F.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\RCXB630.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\RCXB6D1.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\RCXB5AB.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\RCXB61E.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\RCXB652.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\RCXB6E2.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\RCXB589.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\RCXB641.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\RCXB599.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\RCXB5BD.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\explorer.exe.vbs C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\System\explorer.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\RCXB5BC.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\RCXB651.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\RCXB6D0.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\RCXB59A.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\RCXB5BE.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\RCXB5CE.tmp C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
File created C:\Windows\explorer.exe.me C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\locator.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe

"C:\Users\Admin\AppData\Local\Temp\af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78fN.exe"

C:\Users\Admin\AppData\Local\Temp\locator.exe

C:\Users\Admin\AppData\Local\Temp\\locator.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 www.cmyip.com udp
US 8.8.8.8:53 pop.mail.ru udp
RU 217.69.139.74:110 pop.mail.ru tcp
US 8.8.8.8:53 smtp.mail.ru udp
RU 94.100.180.160:587 smtp.mail.ru tcp
US 8.8.8.8:53 74.139.69.217.in-addr.arpa udp
US 8.8.8.8:53 160.180.100.94.in-addr.arpa udp
US 8.8.8.8:53 210.108.222.173.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 www.cmyip.com udp
US 8.8.8.8:53 pop.mail.ru udp
RU 217.69.139.74:110 pop.mail.ru tcp
RU 94.100.180.160:587 smtp.mail.ru tcp
US 8.8.8.8:53 www.cmyip.com udp
RU 217.69.139.74:110 pop.mail.ru tcp
US 8.8.8.8:53 smtp.mail.ru udp
RU 94.100.180.160:587 smtp.mail.ru tcp
US 8.8.8.8:53 www.cmyip.com udp
US 8.8.8.8:53 pop.mail.ru udp
RU 94.100.180.74:110 pop.mail.ru tcp
RU 94.100.180.160:587 smtp.mail.ru tcp
US 8.8.8.8:53 74.180.100.94.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\locator.exe

MD5 4eb484338fb62ed86a86d28013bff9fd
SHA1 50a8d6b264031d2cbd6b63f236e73453a465b416
SHA256 7a78c314dc2ab47aeca9994c85364fa357bdb5d7c9a2a5cb08c0b31d5264f2f0
SHA512 3a56217dd25042f0094a62f13fbb87146333172bcd0bd10772b859d4d56ecea4636a0b992f9599f00695fa5fdac20ce918f9d2bd9f42252d28668898f0262f52

C:\Program Files\Common Files\microsoft shared\ink\de-DE\RCX8BD6.tmp

MD5 23ebbbf2f339ebf6bb8baaea58522990
SHA1 a4e4f29e79cf09e602055af6fcdaecb380c0b06c
SHA256 af3766e7eaeb100284a613a2f39ef88ffb61732557acaef1a764b7d66be0f78f
SHA512 2aa977c50133ccb7c6d5ffd32a52a8f0aebc8ca47954cde53c4675589acad474f85603635d6fcef2d6116a3b44afcb8ed111baa76682850f907069e847162d21

C:\Program Files\Common Files\microsoft shared\ink\es-ES\RCX8C98.tmp

MD5 06e6513c3dd2c924e8937df0ddab2259
SHA1 08da5a125d5f43c0e5c07f9009528dc0f15a2ad1
SHA256 0539eb0512216b0aa7f26eed83f535178854e709e809b8faeec5b9a5faf3509a
SHA512 1a7a28b42680fb07cc272571dd71538e72fcaa672df4313ed8f457a91455b3b658c6826c5be52e0870ea425a3150f61cd88bb6a336bc2f54144cecc959065aa1

C:\Program Files\Common Files\microsoft shared\ink\es-ES\RCX8CCC.tmp

MD5 f39b09b3adcefce2304ddec51e45e233
SHA1 acf8156157fb86085208f29de2ea8c4b75dabea6
SHA256 c884a66367f26d8390317b925406a2dacf79b79a95580fac7748eacf78d7c314
SHA512 fad99ae90e8a760eae2a6632d64d004e302396b10efde782d8f5bddd952560454b79dbba2d8a434a215fbe4ce2f90469d524dba2c832b7d1a3dea13a2ef89a84

C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\RCX8DB0.tmp

MD5 c51ee657a81e376355c6f5d817d9ab2a
SHA1 0416d576d1a74c651aef16742c21f7c466ac0ae4
SHA256 7815bfbc201d12be15ee32a3709de1b4ce7c303676d3ca1e1d3f64d175f5b250
SHA512 e7e1eab3f3ca8e844b404b8f66f1380071a514bb6280b6451f64fe8256852ae7c46f0b828fbac584257bebc321838c5b3d685e2bfdba6e22bc4940fc202afa60

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.exe

MD5 8a247383e8dcabcb0529289a7d702d26
SHA1 9e9d36cf553c83b199368582f4fe3f870e3c6731
SHA256 f7774ceede9c748e8a8200b215776ceeb09077cd372f82fe575b363783d77acc
SHA512 505d03f92ffd9300474a14b8a51c678042c7cb11972328eb5a91df1613bde64fa9617a2fb071ba7e268f0e28fab01f6ba773894226a50750b7bc66dcb02a963a

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.exe

MD5 c72098cd9062c04bddfd592b3868510b
SHA1 5bf0ea3d28fc4637d773488b993189d381909b81
SHA256 25dcfa001f1fcd6bc34da829cae1adc113cf44edc09d6ac8cc9cb0f9cb9bf9d8
SHA512 f11828abc0e955b2dad12c8c5ebfdcd04469ae653b0802e7557ae4a470ba15d72a2e3772afd089afa4078f29206292ab2aa6d9cee1245f46db1ba69773136835

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe.exe

MD5 28e7f2a3a78693da18e15af12e75a8a4
SHA1 dc2ddc148790e5e6461f260f7cdfce74d2da33e2
SHA256 ba710b3654a98482e06b40444b0e3cfef4ac27856d9d1686932455976ae74491
SHA512 86faa1c651c903c015a24f282e522f29fa36ba791dfd7095c990a90f4654ef50fde447bab6ef4cca9371826ca1e7b0aeca34045da14f81d8ed2576b563a98a6a

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX90D1.tmp

MD5 37846019c75bcd742f4a94c64b6cbc91
SHA1 0ef87807c942ee7b85a328f6d3cea9c816083199
SHA256 2b594a1c587e8e331ad93d4100378d728e80455e796f8ed54d58deeec9cb6c6c
SHA512 69fb7cb9f87ff63a77925214066e584e95427955e486ab93d385e24142eb01f1b4bf8e94af32eed2074457631cfa7c62c154a85ea648811202b510378b5db414

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe.exe

MD5 0bb758734407273232c3e0609f0744bf
SHA1 4ec527d99171f4554ac4c41044993746a1ab777b
SHA256 ca4c64591df17bba42dc8c3a6dfb45e293298ffd5be00fd848ff63ea7d910486
SHA512 33d348c0aab8f589290b925a2d9516e59d74f79d0a1474987c2b9e7c6a17bcfed8091d74a2cfd177d93af6bd3b92a6c8a453d05cd14992bfb4d166d24b29c37d

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\RCX9105.tmp

MD5 ee925c9b4748e29530b4eb5386eaf6fe
SHA1 15764631cdf778ff39e24c1044f618b651b86063
SHA256 a30a2d1451cb7ca9bf2560e0b1a0b7478fa3d110fd8702c27fd703e19aec715c
SHA512 ee04d4ef3a77fe6fea823d986c77bdbfa93f70ef9d1fe9a7bfe06373e89edd14f4186329f899330064d9d38ce208d733027cb72d1bb56b1165370d70e3670f2f

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\RCX9156.tmp

MD5 2000166287d65b3030b34cb3e4e33b6a
SHA1 491bbe106c841caa2cfb6702e06a78c632de122e
SHA256 b18023ffee81d9ac8685f1dc35f0f84963e0f9bcac292015758f6291e13fd1fe
SHA512 090f0ddd2fe1cc5899fe49ab4b9e32b2d6d97cddaea9c70218d2d92cde7f65cd01f5cb6353e1df0d0ec33c0c47bedf5642c4316b5248d8da33409f4ad5a77dad

C:\Program Files\Windows Defender\de-DE\OfflineScannerShell.exe.mui.exe

MD5 24acc9b832275ff8b51ec7e97b68f644
SHA1 5d8e1799edb9ca5305b8cd6a8446e324367c2564
SHA256 62227f7139203183e8ab9a3e87b64b3825bd4a03a8928288c783fd807b9f6c7a
SHA512 6599eb549c74bd43c7c2e6f849ce7b4ca1cea0eded9ecd4aa37e2965e0c36ad5f1b11eda9a0609ad7a69ebc38ca97a328f369fda6e8377ff67d0c1f221fcb160

C:\Program Files\Windows Defender\es-ES\RCX9219.tmp

MD5 b216b26d8583d461a9d4f7c4f78377f4
SHA1 d700cc47a5d88154cf1fd3497026f2e599200226
SHA256 9caca0fd8cdec804cac871b88bc42bfcb39457b088842cf051795463f2298ffa
SHA512 7cddf24d4046fd5fc3b2ba09808bd050a723d599b3ddb867a228707b189fd2de32eff13007c63778b5232164fd299bb9974f344a9f4fd028482ca64e3f18b849

C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui.exe

MD5 2980448ac2d26b575853bf19ddbe2e51
SHA1 6a39207278eaa93210da27c84b1c21a0459aaae0
SHA256 a0c5b32de1e3c6838314542e7236c5fe0cd129a10f881b568f2d8179e1dd9521
SHA512 9f99870b3ed53d9824dc89b8138da35c39459394dcedd70ca2cdef33ba52ab3f30733da59f95f2046afe71c3c3c75d7b79b9e69ee586d90e647ff1173c75fbfe

C:\Program Files\Windows Defender\ja-JP\OfflineScannerShell.exe.mui.exe

MD5 9b995ebc0b6ab2f820f2a99d687e4443
SHA1 2ed3fafcc059edde5a9ae61686f01bde069ce6b7
SHA256 ae0ceef10c08a2d58e4bf877045681fb1165cf077b8d861a5300db2bb68cae65
SHA512 13c05dbaf17feca7d98c5c2a0e6b26f3d2714abdcd87600bdd6961ab36e369914e2a903fc3a6d08f086752dd4e4a6233b5cd85836f562819f472a12bb6222ab8

C:\Program Files\Windows Media Player\de-DE\RCX92C4.tmp

MD5 be534778796ad9f9324f496013b88d62
SHA1 02ec2bec53fc50d1d9fcb6afcfa17e7706361dd4
SHA256 3cec327a6e0363654ad3866dd5ac16461e1e01e4bf6c7e1e7de19433d86bec3f
SHA512 2749f8e6d9273a1a20a2bf5b22264a85df3e2005b9936fa6c17d167c99472be80bbc3b9dc162164f9179cce3d6f17902cec380a951ac34ff854a35fd0288be95

C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui.exe

MD5 91a0db8c6c8f6409a490323bed4916c0
SHA1 b9e91e2cae939c479e3a1acd5cde3270d1338cf6
SHA256 07809446a74ff167482ab3bcbb13e6acad8b50836f72df74a928f72e152470ac
SHA512 c96fb5ed2de43a730f2e811ccd1d39e10df2089b7ab2097672f1a8c453b984eb501d9c041a74b096fa175ae96f22ad842d016d2480fcc8e7bd3c8acfc3ecbb04

C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui.exe

MD5 8b3dcc749f39f5085b3887c416f7fb26
SHA1 f550430c374ace1ca4a39a420e4078bef637f9df
SHA256 7e59c5b5048b03e486b5f8897766090ceeabc4414a137949fb683743a1a7d585
SHA512 f836326cb4232f7f80e4e2e66a9a3550031c4c4410f652b1e75044b187c0f30ee60e8d97d8f4596afc5f9a2a9a8dd33278228784ee8bcd5bbffe897fdf7b81ac

C:\Program Files\Windows Media Player\de-DE\wmpnscfg.exe.mui.exe

MD5 4abd4f5007f918fe3c9e4ed4d6b66c96
SHA1 1e9456a31f425f5c104666da891e00bf35efed7f
SHA256 2bf662ccb10c26268d13ea0f634c5f1840dfd3d5102b9d87b6fcc22c4014e6bf
SHA512 4b4b25fdc0bd45ad5894d9942675555cdc9722a9da93bb6fec06868a3c242d755016850ef37eee7846f8bbd8cee72c375ce6224e401b82181644e8d2683d7ae9

C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui.exe

MD5 12b3bb4f732996fb7130fdddfc3a28f9
SHA1 aa29c9d4a7d4cda3ee79ded0c6f4bcad6400b1a8
SHA256 6df415c5a7ba7bc3f120a45a51310308be31e1cceca7751f897c3fdf1b8f9855
SHA512 20c38e15d1a3d20a2ced22ab2fa4a52d358d2cb3035cea9a8b6197e8dd1c42c948d867966001321f90ece11b23561c958fc2c7274797ab17d90128fb545e1d1c

C:\Program Files\Windows Media Player\en-US\wmpnetwk.exe.mui.exe

MD5 b31a81826ebc4006c6c8900225c0f28b
SHA1 f95809eb3d7d3a8c43f39f8dfc0ae2f67d232865
SHA256 04ffed9862283392c76429d292e22a57aa6790842a61a60e02e5fe4dd70aa67d
SHA512 07087692e6e98c19890eab9f2914731c66cc09cc891d6746477dea05c72339104d92525a430e371864c802e8d027d2e3c1d8754cd7682b7687c802779859811e

C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui.exe

MD5 bd4de725f1700992bac9df997585bea9
SHA1 cf74fb9aca32e2fdc14455f681fbe5cb7ce2834e
SHA256 4404070a379a76ffe89806219aeb2baf6cf11260e2b88d705238b48347a6860b
SHA512 9e0ee71898479fe804432ee32d20551d66a33f23513c66337bdb00b967b75be99b39d9f94b69f6e496621f8714a2208a92d98f9a71bfaaa6b4a0a23925ecdef5

C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui.exe

MD5 30a2343e8cdc38444289e5d3b9807e23
SHA1 c3c192b0fd5a27283bf21185dd004d10e06361cc
SHA256 1512f5609be4f572c357b9f11d1a58894b7a5d1e23105fdaddbab5ed07c10b57
SHA512 e03dc71ad0461e17943736cdf957709fc707e4ea062c3649c992a31fd92d90e1eed66b0ac3fbb026953d123aa70a5f2b503226b0696169b216192563d64df9d8

C:\Program Files\Windows Media Player\fr-FR\RCX94B0.tmp

MD5 65bbf548814bb629974dbc7ad405bcf9
SHA1 941ae3ef49518d54c7ddc04bfa484f93d4280401
SHA256 a41eea6ee71de6b5241576f12ed0ac4b0a2d8354f8c9a1aa6ad91d6c02389bce
SHA512 e402d7a6822a92b03ce0763372d1a5dec27fcfec5cd6eb465147663b192ec6ccb1325718d5e80a18f38b053c02560f47534bba697ab269b90ff82368230e8c8c

C:\Program Files\Windows Media Player\fr-FR\wmpnscfg.exe.mui.exe

MD5 59ef7999aad4f419d32b69fc2547a9d0
SHA1 447e296b45f06e26d44c8a1a91fd749319c7d8f0
SHA256 408c9f83aeb10700f39f08ed841a91c762d44bab8a4372a30490be5c6c826aed
SHA512 b0bb46ce2eb4eda25470770024b3530aa0bfe16d78d6085276d7ab745725581ae65b043484689a1fdbb8cc61a6155fd150e384dd6703404d92a67e7e4628362d

C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui.exe

MD5 fd8f738d0bb49b809c829d8db27da8c8
SHA1 75703b4ce9c6536897d5486ca34ad3057d318468
SHA256 ebadc38f7ee7ffd8b8473fccdc9af7f5a8fd34f019b0ee47f9f977e65059fc19
SHA512 e26ddc468411ae20f0349a1bf7c647f2eb9cc627fc1471917dfd5707ad385fe6ef05babe6d79fcb0dd04b3c794cdc9fa088678aed01e6a50dcf7607e27fdf394

C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui.exe

MD5 756d0eda79d4ae31f5d3cb126eb8dbb1
SHA1 c20f4c3a4f1bde319c786ca098f4bf5596a961dd
SHA256 7a6869215cb6b87ab157898c9b2c1d4c2d951cd3082b1b88ec38a545a5963bbd
SHA512 28d0dbbfeb447861748a61bb4155a9dc430cf02bdb42df3ec03966e4bddab130480e8d4c316c2db82b912fb7cdd491cf938c6e8ba4547c55c3ac065a295d5f98

C:\Program Files\Windows Media Player\it-IT\wmpnetwk.exe.mui.exe

MD5 6b7726de19114f1ab191f228020c1444
SHA1 5689c3d4ab010a64e95c6043b9419958f710c8be
SHA256 62b14fddbcb3b7de6a24fc1ad7acff44a43dcfb3b4fab969153c98f301e2ab50
SHA512 3cb7e10bc8d8aacd8d8ed77eda765c00b81e8a54095ae550643f42164666b7da6807dc0922d981e6cedf2e3d097de2281bc5a66c000ba713e27f01ba91575e01

C:\Program Files\Windows Media Player\it-IT\RCX956E.tmp

MD5 97c5015a71c3a4eb81e967865229d19f
SHA1 1a0d5951567b50ac8388e2a2800026aaeb103c7b
SHA256 98920cc0fbc142ac7b0b0e365254bd819c9a1908ffe4ae45ad52674f4e3cf1c1
SHA512 e1963995a1939f1ac085a9e923ea04cad7d34ee84fed9ff1f4befbe1e2400cf43063c63649654600407efcba885db6772a385d712f93fa9e38d68b7271e93f09

C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui.exe

MD5 22ff43215adf3fbcd37bd962c32f7694
SHA1 ccc2427d9bc5b0a83504b9166248c2d3f7e9b40f
SHA256 01650aca878f8e6994a48c49a05b5b6a60f00e88aed44b3c98a140234e13f93a
SHA512 4c33ef7d064bdc22e8779c1dbc3a105d8a15fe559ee012bcded8714d96a8905f9ce48189c57bb22af67c286b1242d68aa90b160171d7b3833972fd3e768f4c36

C:\Program Files\Windows NT\Accessories\es-ES\RCX9653.tmp

MD5 87fa627e6ff384995916e77e431bffa2
SHA1 63fe02b06bc0721f75244bab737ab77d04d39232
SHA256 3a64fcf708558170c79ed3f75ed5e9441cda145a66d575f7a2bc0d4fe1500062
SHA512 ea13b0ef0bf42fb8d480b8bc7e2d6472f5c1db8c6d46203508fecfc79d35ba9a4b5f912c9f75907943f79d98da1a2bfc5037360647ad2793701de393e31dda9b

C:\Program Files\Windows NT\Accessories\fr-FR\RCX9654.tmp

MD5 b07b54c67aae3c9c35ca1aa138fb77b7
SHA1 b092ac8d3da842ff842ebba739a0d6efef54907e
SHA256 886f77aaba02e65a28e2a72eb1a21c8b3e96a8ac40c3de20de980609306cf9ac
SHA512 dd42183e23c96af1faa5c7a4fcddd88c108276a15c458efe5aac526fc480902df96f17e46ce187f720cdc28a0c6058d0d8438361f81a45010c11070e5d6534c4

C:\Program Files\Windows NT\Accessories\uk-UA\wordpad.exe.mui.exe

MD5 666759180e1b6b28b0555984824a7de0
SHA1 fb4dc7bdc2f2b4dec7f430846356e53ddc9fb39e
SHA256 641f6a43738e5537767d299c420306f1047c6d58f5ff8fb99c2df6c9f9621758
SHA512 d77f1dceb0adfaeb7c5db887a187c65d1f90032b606f69ae3b6e8b4652f435d9efa47304e2d7c46ac832e29100be4c0558ea777ecb096a4ceecb4f9991c3524b

C:\Program Files\Windows Photo Viewer\es-ES\RCX9723.tmp

MD5 9203b01aad64802ac46377db0603a339
SHA1 18b2ba9479eba2c80b597c117158985b33816dd1
SHA256 31e3e97e04f132061635dd39c97e71d71bfdccc42827d4a3acb64ba9c0930cf2
SHA512 218d5e3e43f48f33bffddcc416a1b568a6b61258a552a1cf00b12aa3c456666281dfefcc7d33f3e2236fe981abe3dc44d52486320babe77cb8498288ac65eac0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.exe

MD5 5cfe078f8ec9aa473247cbfcc4b51f59
SHA1 7c7b5b0aeaab12f5c15ce34dabd776a707ee2f73
SHA256 45716f14614f4071f0fd72f7b368247f8cf0511fb7ad2e00df64831e3309aca4
SHA512 e4ae79a7bcf571c4d546d3a31c0266538557196f2c87f03d5ce8635c4cc31526ebec20bf6edeb7cb0a76c0302b89c74bf4d31ea43a12cb90c7c50df53fa29bb3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.exe

MD5 9216ee4311fcb95b81755a6c28bab79f
SHA1 a93266a44ff6324ca2eee66167ae44bd81b47a95
SHA256 140c634f8b6b85dda09828803aaa8ed6d94bd9dc4660c07a39efdbf590a894b7
SHA512 c1352a0f8b03ead99f2d1071119189277a57509e3295f69b513e5903e64b620fed60fe6d5b11a4b0c4d289cbf3815981a8aa567565fe79c16f5c72ba17405df6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe.exe

MD5 f0aaa59bd14441cfdae6d1d35a12d2aa
SHA1 0f9ebed2be701f62b40597df959f362cf1fa73b5
SHA256 a8d88f0c822030b4c359b812d3ea67cbe9936f938e3ece47162703669328d1b2
SHA512 c702f17cb64b7c67f9fe71c4337d7c6647d214f3a16a227db3ef9c714a4a2fe9c81e86b958c0882b9cce81ad951d1397504473f459f99f3fb5409bd886484c82

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.exe

MD5 cf21b21fe8e30b394c29c2a9229aeb65
SHA1 4ad671c62f74d5862cce4b4f323a71ed3c9b8d54
SHA256 6fdf5d066ec855fec92996bfb01262ab59c8081e2a23b25c38a6882ac6923b99
SHA512 10a1961b3ef9f5387d87e22a99ed8de6091ef9c291a19b2ade1682009702421cbf9063aea4bbea81a5810b5b361f3e4b48e77526ec754cdfd9a873c2a62c04a8

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.exe

MD5 6ec878d7f625662c8c9f3ab75f8689a8
SHA1 14c89ff6c0ddcd1937eb1a7804a71ba2bb007242
SHA256 70860ff0e8b891d9dcca50779f207bb68e4d6bb1395d10996b266588c0167e1d
SHA512 4d4b18dddc91075a87c739381f5470c0589e53626a62f4ac314f648d8c2972cd0162ea9f16d9da650ce4277e8cc23d89a24b0102052e5eb88e33c349ac60a43e

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\RCXA322.tmp

MD5 1126cdc8f1bcd0bb51d6de8b2c672525
SHA1 6a06c19dc00cb337c465b2041b447ba21e62934f
SHA256 23fa7160049e72d011ac2da8b210de9429e9c2231c1a44a4198142858a44d6ee
SHA512 6f0859af5fb156f86c92dd6b8250abbb58f693c56f2ae9e65210caa2608d17386ae6b00e85523c25d0966b4ccad493cd183bc5198bd806f5841c4ff2a5f41074

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\RCXA39E.tmp

MD5 ae06612e478eea153ed69300d9397fc2
SHA1 3aed97c9856254a57a7fab406b77ccee604420c8
SHA256 a8b46f932112c24fa7af5fa56f47e8197326004d331980bcfce5539516d16b4f
SHA512 b7ad5b8ae927e652343cfe8ce588e656776c49f7b4f171495f49c5433942da4e4e3d6a75da7e01e786b858b3d6406143c81de20516eb6b9f7607aa0da8147c8f

C:\Program Files (x86)\Internet Explorer\de-DE\ieinstal.exe.mui.exe

MD5 c9b809360444d92dc79cbe6ff3049401
SHA1 75ac1944a5ac3e416d582b215ec7797b1d9b5326
SHA256 bf12d8dfbbf0ddb0cd4898dda90592df7e0b674d51bde55eb47af5c8979c6cd9
SHA512 12205a872ee51a1fd6db540b56a5bfc38c4e7a3d051aadd450a993df614d972eeda859ac5d74f50599c3a236f86f5f921047a8b9d9b8ef7f58305170b7724aa7

C:\Program Files (x86)\Internet Explorer\de-DE\RCXA78D.tmp

MD5 4e31bcbea45f3a98c82ad39ae06554a1
SHA1 a5c3ce5121643fa983060c6ea747af3d6b9aef30
SHA256 d4511c4f2a90eb244e559e52583e10e7b09158205aca281928854f49f0f78f99
SHA512 75352879b809a27d9bd10e08bc07ec719bcf7d61d3cbd1771ab7d1dd072711034866a1eb15cad642c3066c5bf3758f560116102bd4e9f8a6fcac677d4feea8e7

C:\Program Files (x86)\Internet Explorer\en-US\RCXA79D.tmp

MD5 e08a511c407c767fc3f2f464a2caff9b
SHA1 88f65ab4161cd33df8b08f85aee7601a3202621f
SHA256 2251c02e58a74478f160fe847dc19ab6b07c2bc8d69f4d26f1d51c97d1305748
SHA512 bd6ccc5b0ddefc146224961acdcede697f743f352dca34d01e936f8f5795c40b0d7dbe78b4a4e469308a69f34348e568f126b9bd0809bc5601c19de9986f9b18

C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui.exe

MD5 8ee80d926c8695057df271f0bcdc8958
SHA1 effe5f1c274ec08b971b2d1e33a811336ee4f23f
SHA256 ec818a006964033a912c9bd3927696cd28949935f7a629578adba7dcafa576af
SHA512 43728d6e07230ef045289b03878d8ceaebb1102f28ca746b1de1b4790ba93961bca400ed4dfa16c4d381d499d3f970c897d01e1829cdc06f26a35fabc4f26dfc

C:\Program Files (x86)\Internet Explorer\es-ES\iexplore.exe.mui.exe

MD5 46c021af4d2e5d6fa64e2e4e4f7736ce
SHA1 45849ec689a8ba8545741418d48c4c3f0abff51b
SHA256 cf24a1cfe1f10dedb9daf01b58e5542f2a7cc7f205a59d3b30335b0c76481c80
SHA512 909cd3fe752cd7169507d63774eda2c14269ace6e011c476d49997a62c8cfd20e65ee2fd031c2ebfc734fdaf764257831ea43da862b3c12e2707b38e617dbbbb

C:\Program Files (x86)\Internet Explorer\fr-FR\RCXA81A.tmp

MD5 723efd7f2b6941c34d89251aa1472b13
SHA1 869d7142850bda1c46fb35c225f1d12d4c6779cc
SHA256 e7b86cf0f5770043a69c1ac63c0c4b93368e14462c753d5b3801a57798ff329c
SHA512 c905c6267a26ab095f02af3d085a90d634245ad2907abdd2b63df2062e79f16ecad0f90864aa894e3c424e2fe64df8d12a0a5f6000cd25d5a3d50e625a1b3366

C:\Program Files (x86)\Internet Explorer\fr-FR\iexplore.exe.mui.exe

MD5 b903728c26abe6a387f2e8fff7fa2af5
SHA1 6d663b74ec7b2ce297ff0f204491feb916602713
SHA256 c95528df67d66d4db3f5861bc1dcfad319e48644679c06be8066998fb7ae5113
SHA512 7745ba3a76c0e32d3de93108513cbc6dd2f62d3597bb16eb49aefa012ae660fcbe72eb39ec6f90d71b1049d919bb7dff075f3bd3afa8cf98676de18dec4be7f3

C:\Program Files (x86)\Internet Explorer\it-IT\ieinstal.exe.mui.exe

MD5 6f00b68dbeffc1f226caf0525294b9fb
SHA1 9a74a5e78a605f47f5c5a1deadac798066cf45b2
SHA256 fd05894a443d59a2b9acb079a65bc41b23bfeac92b16224e93b44120c5697733
SHA512 6c87fdcb75f9fc8ffefed15a47615fb884a865f82f718bbcbacf7eaf56b9f125764ecd9d49f34f14656b7e106d2a460232718870eb99509d6bbb9778270e6086

C:\Program Files (x86)\Internet Explorer\it-IT\iexplore.exe.mui.exe

MD5 191058c8cc5bffaf2204e0a4b6f411be
SHA1 ede904cdc81a06a5ad0189f17817dfff1a9562f5
SHA256 751f7b0e445a84482f5a161445edb5e95f24c61a8ff75c16922881bc67f8913b
SHA512 a18e1e71b93f8d85e943c62791c672e818a478ba44020105a1eb2939e4d7b1821886d7d2d3ad8ad5c77871cfaf4599657de4941edc264d068f9d623e6975a7d2

C:\Program Files (x86)\Internet Explorer\uk-UA\ieinstal.exe.mui.exe

MD5 d75c1af135022613ca84edf4346df256
SHA1 db62679a438536bac93846ec161bc78c5054aa14
SHA256 cfb26c3688b42e290c1a9ffab1d19a26e73a0360e34e702eefa58adfc07dc3fc
SHA512 55fe15da99c74ba297bd659c6e262373945e9e4a0bab52282c95e64a25219733be46147cb57c747c176a3349c915c9c59653bcd698886875bd8dc75ef9791c0a

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXA971.tmp

MD5 16b9ff387800bf8b2b4eec92281b3d36
SHA1 4d5e1ee2f1f8c97e8fe408dff26191d3ca7eb21e
SHA256 6e14781859ac4bb11b7f6cddc2c73f6126a69ca27c7568f7dffcb52e5353b231
SHA512 fe4ea2a5bea088513e99e2e7e3c6cad281ef8d91f4cf9fb91587f9e8f9e51e1bfd20f58edba14b96a6de62babd27dd72df4caa4e2a15308b05610f0e510e522b

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.exe

MD5 bc3a4a388f1283fe8490672aa86e869d
SHA1 3b5aa07f99d1a70dafe8303d2a2eaf7921b05e31
SHA256 0d36a02e5cf5507f4ff152a4b1f5eb628f478f0f786f1330a75a803145118da5
SHA512 8d952a8fd2bad6335c30dc75108ea589675abbc8da92330b0b80726d37cae7a05d1fb88cf3a388463bcbafc528cbec15d5afcaa78951798fa87e2c9b338523e8

C:\Program Files (x86)\Windows Media Player\de-DE\wmlaunch.exe.mui.exe

MD5 8e85c25ee37386d0159612ffee307aa3
SHA1 b11a0e642a8ad85218bd310a8fd27a1a2da1a9a8
SHA256 bc520444ffd2a6ff1f36fea8afa0be80fc0578e37cf2defb4deb0ef7a9783218
SHA512 930a95ace43bd6ed33976b93f7f94e41aadc3311c855159a8871a6063072201da5c087f6e27d0e0faa8f53c076a9db58f817cdb06f3b76a3ade44cdc8fcfa6d4

C:\Program Files (x86)\Windows Media Player\de-DE\wmplayer.exe.mui.exe

MD5 6b17f096c61cd2713fdb71a1c8d5c4b7
SHA1 1a2723143eb2badfeae23b8472860040c8582812
SHA256 941737a96a72e693278acb543729d4cf0d59b24c3e8a2d7f5e95614dc4559134
SHA512 fed9c7c2f2877006b211e7272c413b20df82b5e852908d2856c325fcc5a9a5e2382ccec2f842e31a7f5baa8357233de7b45453c6aa8553906580b26c9252ea60

C:\Program Files (x86)\Windows Media Player\en-US\setup_wm.exe.mui.exe

MD5 b56c9b0afcc305969248ac54494dada0
SHA1 a040bb398738e233d5e7fe4695fad267d0cb6c57
SHA256 ddf26d017f054d9d8cb025a00401f8dc3e318a2a1ec6bcdaaffcf519733de148
SHA512 b5543ea860864fab07ac4393bf97073e2769266fb9b39e185fcc56a7fdd292cf6e06b7049e61b330052ce3c5c6d76911995244de1c0f521aaa508d0365c684bd

C:\Program Files (x86)\Windows Media Player\en-US\wmplayer.exe.mui.exe

MD5 4b96dc1c5bcfd6bff149566b2f543e8f
SHA1 ed1b820ae36cbb6c9dc9cc7a181fcdc662097d68
SHA256 97c40f8c2c861402c4a8a1a3595435ce12d4ac21dfb6b1b00b582ac48542ab2f
SHA512 7a79621cf562a914d65dba45b6b227f24e6a1a33dd189362bf5388cd21ed5fa54ac2051504711b096ec5853b67efab2da623ead19b2303a08d1392d0b54d8307

C:\Program Files (x86)\Windows Media Player\es-ES\setup_wm.exe.mui.exe

MD5 b25711262d9208003543ddeaa6c5f0a1
SHA1 1d07992775eafdcbad8e2a84db59055812ca56ad
SHA256 30ce99b2cd6c65a7846ac5144b289c6701f90bf29688304f3c6b646a79a5500f
SHA512 39d8b286b02720363918a17bdd2b9d6f7f9a5291cee2fac7fbbd57bcc1de345fc3bb6992e09706344aab0b3cad5ee70089090e890b8aed1ca3a454a693071e76

C:\Program Files (x86)\Windows Media Player\es-ES\wmplayer.exe.mui.exe

MD5 a962660ce46813abbdb699d519af7c1f
SHA1 07189f84bd1de31bfbacc639b8d21c30b5d5536c
SHA256 ebabf5d7ceb320ca9616cf2699006ec3042e01427646a7f506ede166789295ea
SHA512 16f932e04fd3f6d0133db5e1595543c59216c6a53f8c83cda902443bddd82911dfe065cd59f52c19b8c81653a3057fb52824cbcce67564e0978dbe9cbefa1dda

C:\Program Files (x86)\Windows Media Player\it-IT\setup_wm.exe.mui.exe

MD5 60e32de09a76678a30141d3e809835f2
SHA1 782e019090d7d9215f755fc99feb747672ca9849
SHA256 7e3a8ce33c1037e155ab8ad5e56946aa341f4e8a0c98007f11d8e002c0ca1173
SHA512 7991303b5348e4017957fa4dae9c7e99aea74db1f4b372dfa7639286e1e2f97e697fb4a7083f9bd4519b0ec191d05628543cd9a94c249685d6a9f8b60997e72a

C:\Program Files (x86)\Windows Media Player\it-IT\wmlaunch.exe.mui.exe

MD5 989fa7854d220fa1f009849dc595c1ea
SHA1 d881a0e5a1c96def186538228014ad8642fb284c
SHA256 33fd4d6b5b6325c26ee6927b194dfa4160a5b1d772b5108ed00e8a1a4d50ea25
SHA512 761a3fe21b0f4910e0be6b02e5fe982771d9642408a09db34b528ecdc1d8c246af69d43af22de9c8ed3fef74fbfae3eaab5dec7dd84d5d50750faa6d8c6e7c51

C:\Program Files (x86)\Windows Media Player\uk-UA\RCXAC07.tmp

MD5 f39e712de8fdc92cb1486830e2b3abe6
SHA1 1875280e71e13ae87e1c414affc9fa30c8fa8cb3
SHA256 c3ef55fbb3cd7639546ab3e38681edc8ada45dbc1deb14719c402f1a7a714a97
SHA512 adbf8cc3991ce40fda7c1279b5241d3f95ca7525a733670d32d07b5ffaf76fd4c2e6a9cadd9fc9cc0e7b5c7771678352f13ada349a79acc0c9e95443fe4a9441

C:\Program Files (x86)\Windows Media Player\RCXAC3C.tmp

MD5 0a6589003f0b0df5c8fa94eeb460d8f7
SHA1 6a4252f22d029867c796b2b2afe8ef6be7d17f2e
SHA256 fdea52b074e358d9fab0cd3d94a0495b59e508033d6915c9a1853b63a60dbff7
SHA512 9490250437c7d8f89e101ce15a2daccd77e695f0cab9cde8b1a2a1f59d418555d7d777161f260f03be4c4dd751b859db176d2808ac847bdfbd0155978ba3a481

C:\Program Files (x86)\Windows NT\Accessories\en-US\wordpad.exe.mui.exe

MD5 649950b0bc7a8652af94c786579dbf21
SHA1 e89cdd05c54dfbc959de491b37e5995766e24efe
SHA256 a903e7b6d595fb48380ddca642c4ad1da71ab69797bb0de055b0a9c7af079dab
SHA512 7922575596cd70fa274fb2d1b7d4fa8fc879a974c2e8b1aca62a3ed6f519ac11229e96e32560abde70bf5d3de68105a853f5a60c3118c74390f0766a68004f34

C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui.exe

MD5 9e013800aafaa72957e92de2a8b0e455
SHA1 2189d04759a6ecfedabf5c734621bb3a42e20bd0
SHA256 b813a7047832a0c7c41584262f35280e2ac0bdd98f7983312fff337bd9710a70
SHA512 0865b0d16fb5f566d65a21ed7f904c45a162c001c09178a9fda4f4f124c280f3b7ee69c1f2ccd399c0d4809154424c00eea8bae5fbf7c371382aea41ed88e99c

C:\Program Files (x86)\Windows Photo Viewer\es-ES\RCXACFC.tmp

MD5 f80439fdd517f1c408074bbe682e24ec
SHA1 eb5a10ccfbbd8007b11f75115e1832cec29edbf7
SHA256 33a2388889a43cec30a3322b3b4b197d316eb0cad944f3a91ecdce18e50b4485
SHA512 bd276bdffeb04aa75a21b74e8cee08a5af55e7e174054ecc4436e22dc3332a58197afe9c629313f01b5aaf362474755a575af2f2ea2b094bdcd3aa3066d88fda

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe.exe

MD5 c15cb53d0964326177e9a1d742fb662b
SHA1 705f19070ebaafd0c03938beb54a1c3c9530c411
SHA256 04aaa09ed2acecbd24bccbdd5751002645aacd398cbf5eae750e6a37fbf0b98d
SHA512 ff7069c5966fe4bbed6ca4ba5fc1af152f320a8519bc302c28963fa8602cd47b1bbc940fb7ea98baf195743e3f0060c3ce66b024429c2492d94533772e6a20ff

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\RCXAE4F.tmp

MD5 d9692ccbc9a8a9d4fb6630ac90a2cd8c
SHA1 4d42180f49385a9fa6982ce52a114704142a353c
SHA256 333aab8beadf34a3d696404aba4511d9f7dbb95db4f63e5f72b5fa9e1d8aab79
SHA512 7d7d6efc827fce89fcdeefdc9fdb4af76226c6e88188267f54dde516c4b8d76ae469c00de15f14f83d1cdcc1096c73ac606d72807325d23a5f2f400440f8872b

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\RCXAE72.tmp

MD5 f2deb65cd4aff96bf5d6545685be103e
SHA1 fcbc637b394e455ee8226612268ff9a6fd492aae
SHA256 d6d384c3868ec40b14002d7a5bbbf5aa36ab4699d7d507d9fde2629c4e660146
SHA512 7b6ab021ea4e43837dd750b1290cffbce4afa8af864233cd4048b4543e12a854596f46cb98ffc6271229552faeb664190eb30ded25c9fa29dd3ba415271e5275

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe.exe

MD5 ab63cb3e20cbdbc27ee68a1aee34e5bd
SHA1 565143427540bde91dd082bfe6e5817c62d4fb47
SHA256 851988e973586ebc763351447dbcd21aea13cefdb2be1a7118b9aefea9a7a919
SHA512 8aab33e380561d920622d098ebe6a4b0526221a11baf3b2902f0a510f6e5341c811d438d519cee4787637d42e49aaa6bf78b0d86bfd6205b66de2982111129e2

C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe.exe

MD5 3155ef19a3b8d9b4d6936be87874ef2d
SHA1 52c48f58674676242076a468ed6640944e8443a3
SHA256 899f33bb176f975e6069bab269b443a8b83225c16a96c258cdb02e9b739c2ae2
SHA512 6c992cc67a2c212e3f0287839d4c30ca4320b9bac756bfdeed6bd5b0bfbe6828dfdaf4100641894e93d17277766cb129d9c022192b2157675c06abe560c6e191

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe.exe

MD5 bedae2af7db8b8fcc91b8aa75c53f92d
SHA1 e45a0e672dcd89a81114ee5e7ec8182aac1917a9
SHA256 d03833d6831468d95658603814e21202dc14f9ce7f49c0bc3f918d0104bfe540
SHA512 a589572a8d4f327eecb0910af00a20751b5d6b1fb4da2b87588776bc57bcf42870a5c13d81cff9e28f1d1c0fa981c4cc4bd52e3c5642ed8d3a93cd24d32ff826

C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe.exe

MD5 e0718f5e3874aa43ad23ec419e5c1135
SHA1 72886045e91415c99677b3a8f97e0b58b74b5f9a
SHA256 28ad9790d64aa8f15571735346fe62f7d759ef69a9a2bbc09eafa7b2aaddbec4
SHA512 1f580df5b8e00a497b213e847a5276730afa849b5b1d062f7d20b88aca6d50a9dd3ba423c4fa99c39ee1597e39addb2f9d3441f5553b751ab8bb0b608c84c517

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe.exe

MD5 1fdbcb21bbbc929df65e9ed32a58feee
SHA1 feb1fa6c3b931ab6670f26c561c1eb79555f1878
SHA256 cb9db9088d83c883a83c02695a19a2576e384ff383294307c848b2d36d07ef9e
SHA512 fe5fe8263d7249facd56be2bcb6a5b775e2636deb72197e767bd2c133ee0a155d8a82b8b30b6e482de678eb08ace0944b87fa9cabea01781daca0050dbfeab28

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe.exe

MD5 587c17c2f6a07acb90c6681c5fe11b9a
SHA1 b0e5f3a85e16a098bbaa123fca9ba7d4bc922b11
SHA256 a75a2247fd346a884981c3128c54454e0424060a265d3bec886bd17837cebc5b
SHA512 9f0d7a4f0e5c68cccaf44c3b7bd929905b0fea52ff4d4a8cb77d90d8d2061c67af7a2eb1025d24053f55defd8ae1c6dc29454d6d193e0c9bd77031b5d8d8ad94

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe.exe

MD5 3c1fa59ceb48b5ec010a5179dd6d0478
SHA1 bd15a150e980bf8c1df65780c1b900b25b897c92
SHA256 5dc108b64e4e0f5b94a1793ecb2e03a13fd357867b579c71625891b2c56c6f5b
SHA512 4c34c04ac00c2eefef7b468363249252fbe7c14a7f6a46839ca4a0de4131e6ec03a52025b207c54d7422892e3a2f505b346f9e78ee668fc012d14e1016936481

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.exe

MD5 9cce6410b9f2c8c84a1eed802bda9105
SHA1 9e7bd187c737914053bbb9c9f6bcc10b1da73171
SHA256 abff80e5fd213c727cb468b04212d496ecac5363c8cc6eef2d0f6fabc69e02f4
SHA512 0b18564a2686e7cac885f349e4f80e38a6c46707566250c8e720425dd6d0a8065aaa9cb2c9647f8cbf7eaaefdb8810225f6548ead235e44367327b84b7865193

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe.exe

MD5 888c3dcf9b00ebae50a4881b1db301e0
SHA1 b5a666633a15385fee143ce2f8388297c266d03b
SHA256 d9b80a8a606d10bdf30df4e798eac421e703af15ed48465818a9d5ef19e142d0
SHA512 c5b6419bab4713b958dc8a59b1a483d871bc1c011b1376377a0a17e1afa224ccb9e88b3b8d81cad3b14100f3af39bed37b673295f0126314f553a7109ec71ae0

memory/112-3197-0x0000000013140000-0x0000000013176000-memory.dmp

memory/112-3199-0x000000000EB00000-0x000000000ED6C000-memory.dmp

memory/112-3205-0x00000000120C0000-0x00000000120D4000-memory.dmp

memory/112-3209-0x0000000012690000-0x00000000126AF000-memory.dmp

memory/112-3218-0x0000000024BE0000-0x0000000024D72000-memory.dmp

C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe

MD5 14f102c8cf30dab61d690913acb78857
SHA1 40fba6a0c6c5dc5f7e655d8b27c46471bf1830be
SHA256 b9dae402944b58e26e92a663b0abe09a334e172256b96a7287101d540a5e7706
SHA512 d82df1ae21b5d6494e5d3c9556bd40b2700243cb22170edd3cb68a9b2361f1cd478c688d8a85aaaaafe58b8175dbe67a7c8938c7183592a37249f7aafc301417

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe

MD5 0862ca0349c08062d899a29aa4a471c3
SHA1 d488a7f57e9931c7d15a7c4a1eab08d3e04cdeae
SHA256 f3dd360a7fb86e352cb77a487139340615dcde440d5e8011011092b683c62cf9
SHA512 09748a9a353ac1a3a59cb76e7695fe19d87bfc49488a85b326f5236745e39553d3d33f513e0ce7a1ef407f5b623f6bcf54c0c94ef414c62964605cbcd87820a2

memory/112-3198-0x0000000004B50000-0x00000000065EE000-memory.dmp

memory/112-3210-0x0000000012960000-0x0000000012C11000-memory.dmp

memory/112-3208-0x0000000012650000-0x000000001267D000-memory.dmp

memory/112-3207-0x0000000012630000-0x000000001264D000-memory.dmp

memory/112-3206-0x00000000122A0000-0x000000001245C000-memory.dmp

memory/112-3204-0x0000000012030000-0x00000000120B3000-memory.dmp

memory/112-3203-0x00000000006D0000-0x0000000000709000-memory.dmp

memory/112-3202-0x000000000FAB0000-0x000000000FB29000-memory.dmp

memory/112-3201-0x000000000F850000-0x000000000F8A9000-memory.dmp

memory/112-3200-0x000000000F7C0000-0x000000000F842000-memory.dmp

memory/112-3211-0x0000000022FA0000-0x0000000024A3E000-memory.dmp

memory/112-3401-0x0000000013140000-0x0000000013176000-memory.dmp

memory/112-3417-0x0000000013140000-0x0000000013176000-memory.dmp