Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2025, 14:34 UTC
Behavioral task
behavioral1
Sample
977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe
-
Size
33.3MB
-
MD5
158c2e6b90ab30f6fdf653255a2beba0
-
SHA1
3288d9c8fb3642d2d60f534dd05a7b24417dfffd
-
SHA256
977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802
-
SHA512
6003425b0c92b3ebd7608070b1509e6de2148762dec291c44a6fda954bf1b4849542a6115987333267c67ee65b88416d1e6ad80a0bd8969020fa459916258a8d
-
SSDEEP
786432:8hl/8uLBgD7MkrYvUL8QHYx/2FHiPtP4erWXCYlOFOrAaP:878kOD7HnLVYxOFHiPZ4eD+
Malware Config
Signatures
-
Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
-
Gofing family
-
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral1/files/0x0003000000022a7e-4.dat family_gofing behavioral1/files/0x0002000000021ce1-5469.dat family_gofing behavioral1/files/0x0002000000021cb6-5525.dat family_gofing -
Renames multiple (51) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 22 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\afunix.sys 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\gm.dls 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe -
Manipulates Digital Signatures 3 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\wintrust.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe -
Loads dropped DLL 64 IoCs
pid Process 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found 3424 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\Favorites\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\Pictures\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\Documents\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\Videos\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Public\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Offline Web Pages\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\Links\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Public\Libraries\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\Downloads\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Public\Documents\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Public\Videos\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\3D Objects\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Downloaded Program Files\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\Contacts\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\Music\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Public\AccountPictures\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Fonts\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Public\Desktop\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Media\Desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\Desktop\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Users\Admin\OneDrive\desktop.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\en-GB\SyncRes.dll.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\mprdim.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\ntprint.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Storage-VSP-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1266.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\DismApi.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\dmdskmgr.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\es-ES\jscript9.dll.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\wbem\ja-JP\WinMgmt.exe.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Printing-XPSServices-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_1815bafd14dc59f0\netrtwlanu.inf 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\AppResolver.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-UtilityVM-Containers-Shared-Package~31bf3856ad364e35~amd64~~10.0.19041.1288.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package06~31bf3856ad364e35~amd64~~10.0.19041.1288.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-RestrictedCodecsCore-WCOSMinusHeadless-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmwdidhdpcie.inf_amd64_977dcc915465b0e9\bcmpciedhd63.sys 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_8bc1bda6cf47380c\MXDW-pipelineconfig.xml 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\DriverStore\ja-JP\c_sensor.inf_loc 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\en-US\RemoveDeviceElevated.dll.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\nlsbres.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\updatepolicy.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\wbem\fr-FR\mispace_uninstall.mfl 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\DriverStore\de-DE\netjme.inf_loc 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-Client-Shared-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Printing-XpsDocumentWriter-Opt-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\DriverStore\FileRepository\mlx4_bus.inf_amd64_4c426f3bebc68844\mlx4_bus.sys 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\Amd64\MSECP-pipelineconfig.xml 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\DriverStore\es-ES\netpacer.inf_loc 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\AcXtrnal.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\TaskApis.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\ja-JP\SimAuth.dll.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-HypervisorPlatform-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsii64.inf_amd64_0f02175b17cd3f66\mdmsii64.inf 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\DriverStore\en-US\spaceport.inf_loc 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\KBDLT.DLL 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\NmaDirect.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\Keywords\{A5A7C794-3D59-41DF-915F-19ACDA526FC9}1046.bin 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\SmbComponent.cdxml 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\es-ES\TetheringService.dll.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Online-Services-merged-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\DriverStore\en-US\c_securitydevices.inf_loc 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\de-DE\auditpol.exe.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\ja-JP\EventViewer_EventDetails.xsl 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Vpci-VirtualDevice-Gpup-merged-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-OfflineFiles-UI-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\at.exe 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\de-DE\IpsmSnap.dll.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\pt-PT\cdosys.dll.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\srclient.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\vbscript.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Package-base-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-UtilityVM-Containers-Shared-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Portable-Devices-Package~31bf3856ad364e35~amd64~~10.0.19041.1266.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ServicingStack-Base-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fsvirtualization.inf_amd64_078671a0cdfe2870\c_fsvirtualization.inf 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\it-IT\comexp.msc 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CallButtons.ProxyStub.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-KernelInt-VirtualDevice-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-VMMS-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1266.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WordPad-FoD-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\DriverStore\de-DE\wvid.inf_loc 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\DriverStore\es-ES\c_fssecurityenhancer.inf_loc 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\System32\DriverStore\es-ES\image.inf_loc 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\blockCommon.xsd 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\es-419.pak.DATA 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\Java\jdk-1.8\include\classfile_constants.h 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\manifest.xml 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_contrast-black.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\ui-strings.js 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\ja.pak 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\7-Zip\descript.ion 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\EmptyReport.rdlc 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\VideoLAN\VLC\lua\http\view.html 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\WideLogo.scale-125_contrast-black.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationSensorCalibrationFigure.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg6.jpg 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\share.svg 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\ui-strings.js 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\Common Files\System\msadc\msadds.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Locales\pl.pak 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SmallTile.scale-125.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-150_contrast-black.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_es.json 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-400_contrast-black.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_anonymoususer_18.svg 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteMedTile.scale-200.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsLargeTile.contrast-white_scale-100.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSmallTile.scale-100.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\ui-strings.js 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-ae\ui-strings.js 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\vcruntime140_1.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_iw.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\Microsoft Office\root\Office16\Resources.pri 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.contrast-white_scale-125.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymxl.ttf 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationCore.resources.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\msedgewebview2.exe.sig.DATA 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageSmallTile.scale-150.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\MixerBranding\mixer_logo.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_contrast-white.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarWideTile.scale-150.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\example_icons2x.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.tree.dat 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_contrast-black.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.scale-125.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WideTile.scale-125_contrast-black.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\FreeCell.Large.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7cb.png 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\msdaer.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\sr-Cyrl-BA.pak 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\PolicyDefinitions\es-ES\RacWmiProv.adml 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Speech_OneCore\Engines\TTS\en-US\NUSData\M1033Eva.tbtdirection.WIH 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\_ServiceModelEndpointPerfCounters.vrg 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RedistList\FrameworkList.xml 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Fonts\bahnschrift.ttf 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Fonts\phagspab.ttf 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\INF\ServiceModelService 3.0.0.0\0000\_ServiceModelServicePerfCounters_D.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\INF\wsdprint.inf 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardCreateRoles.ascx.it.resx 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\JA\system.data.sqlxml.resources.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\error.aspx.it.resx 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Serialization.Xml.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Fonts\MSUIGHUR.TTF 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\INF\avc.inf 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Ace.dll_NON_OPT 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\manageconsolidatedProviders.aspx.de.resx 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\JA\mscorrc.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Activities.Core.Presentation.resources.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ISymWrapper.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\Microsoft.Activities.Build.resources.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\GAC\es\Microsoft.VisualBasic.Compatibility.resources.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.Runtime.Caching.resources.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.Activities.DurableInstancing.resources.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.WebHeaderCollection.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\PolicyDefinitions\en-US\WindowsFileProtection.adml 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\PolicyDefinitions\ja-JP\DistributedLinkTracking.adml 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Provisioning\Packages\Power.Settings.PCIExpress.ppkg 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Boot\PCAT\cs-CZ\memtest.exe.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Fonts\cambriaz.ttf 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Fonts\constanz.ttf 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Fonts\h8514oem.fon 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\INF\UGatherer\0C0A\gsrvctr.ini 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.WorkflowServices.resources.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardPermission.ascx.de.resx 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\aspnet.mfl.uninstall 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Fonts\ssee874.fon 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Globalization\ELS\SpellDictionaries\Fluency\fr-FR\emoji_bg_c.lm2 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizard.aspx.fr.resx 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\SmtpSettings.aspx.it.resx 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\PolicyDefinitions\fr-FR\NetworkIsolation.adml 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Speech_OneCore\Engines\SR\en-US-N\c1033.fe 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Speech_OneCore\Engines\TTS\it-IT\NUSData\M1040Elsa.keyboard.UNT 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Fonts\georgiaz.ttf 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Globalization\ELS\SpellDictionaries\Fluency\it-IT\charactermap.json 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\UninstallSqlStateTemplate.sql 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\sortkey.nlp 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_1x1.gif 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\PolicyDefinitions\MobilePCPresentationSettings.admx 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Speech_OneCore\Engines\SR\de-DE-N\l1031.wwd 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Speech_OneCore\Engines\TTS\it-IT\NUSData\M1040Elsa.keyboard.WVE 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Cursors\aero_helpsel_l.cur 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\aspnet_rc.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.resources.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Diagnostics.Activities\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Diagnostics.Activities.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\PolicyDefinitions\de-DE\WordWheel.adml 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\PolicyDefinitions\es-ES\nca.adml 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\PolicyDefinitions\fr-FR\Sensors.adml 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Boot\EFI\nb-NO\bootmgr.efi.mui 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Fonts\coureg.fon 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\system.data.sqlxml.resources.dll 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalResources\security.aspx.ja.resx 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\normidna.nlp 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe File created C:\Windows\Cursors\arrow_im.cur 977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe"C:\Users\Admin\AppData\Local\Temp\977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1112
Network
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.28.10ax-0001.ax-msedge.netIN A150.171.27.10
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239356671167_19HPP7IIREEX4KA57&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239356671167_19HPP7IIREEX4KA57&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 414304
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B399000CD3A8420AA153FB8FB4005BFC Ref B: LON04EDGE1118 Ref C: 2025-04-03T14:35:13Z
date: Thu, 03 Apr 2025 14:35:12 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239360492574_10ZLIEYNNW01DP6QS&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239360492574_10ZLIEYNNW01DP6QS&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 653514
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4C3D7FAE8850435AA59FCBC8E663F9EE Ref B: LON04EDGE1118 Ref C: 2025-04-03T14:35:13Z
date: Thu, 03 Apr 2025 14:35:12 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418540_1UQTKN6JO04LNXB5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239340418540_1UQTKN6JO04LNXB5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 676162
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 32519DF889564B2BB67625338D750171 Ref B: LON04EDGE1118 Ref C: 2025-04-03T14:35:13Z
date: Thu, 03 Apr 2025 14:35:12 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239356671168_16FGHU1WN2XYJHSC0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239356671168_16FGHU1WN2XYJHSC0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 606526
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 90F9447EF6994C9FA02BD321B6D2C476 Ref B: LON04EDGE1118 Ref C: 2025-04-03T14:35:13Z
date: Thu, 03 Apr 2025 14:35:12 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418539_1KFG8UNZE5MUR2Y24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239340418539_1KFG8UNZE5MUR2Y24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 577346
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F2F3009CEF154D35B9062D4E3FD864F0 Ref B: LON04EDGE1118 Ref C: 2025-04-03T14:35:13Z
date: Thu, 03 Apr 2025 14:35:12 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239360492575_1SSJ82L6CB3K86OHJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239360492575_1SSJ82L6CB3K86OHJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 802236
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 60CF1A7CE86D4750868BF47A05532FB4 Ref B: LON04EDGE1118 Ref C: 2025-04-03T14:35:14Z
date: Thu, 03 Apr 2025 14:35:13 GMT
-
Remote address:8.8.8.8:53Requestc.pki.googIN AResponsec.pki.googIN CNAMEpki-goog.l.google.compki-goog.l.google.comIN A142.250.187.227
-
Remote address:8.8.8.8:53Requestc.pki.googIN A
-
Remote address:8.8.8.8:53Requestc.pki.googIN A
-
Remote address:142.250.187.227:80RequestGET /r/r1.crl HTTP/1.1
Cache-Control: max-age = 3000
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT
User-Agent: Microsoft-CryptoAPI/10.0
Host: c.pki.goog
ResponseHTTP/1.1 304 Not Modified
Date: Thu, 03 Apr 2025 14:25:51 GMT
Expires: Thu, 03 Apr 2025 15:15:51 GMT
Age: 586
Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
Cache-Control: public, max-age=3000
Vary: Accept-Encoding
-
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
150.171.28.10:443https://tse1.mm.bing.net/th?id=OADD2.10239360492575_1SSJ82L6CB3K86OHJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90tls, http2167.9kB 3.9MB 2799 2793
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239356671167_19HPP7IIREEX4KA57&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239360492574_10ZLIEYNNW01DP6QS&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418540_1UQTKN6JO04LNXB5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239356671168_16FGHU1WN2XYJHSC0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418539_1KFG8UNZE5MUR2Y24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239360492575_1SSJ82L6CB3K86OHJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Response
200 -
1.2kB 6.9kB 15 13
-
1.0kB 446 B 9 5
HTTP Request
GET http://c.pki.goog/r/r1.crlHTTP Response
304
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5732fccad729272df581f1741c50dbefb
SHA1c592a22187a2ee7e6dd0b57ea600deed28deb70f
SHA2563eb8d694d1c458221f6882075baaca8692021c1a41fd67ba125f4a6a74ea4c0a
SHA5125485d0a7f1940edf98bda8717ac362f63272dd0ae3a5e21ebbbc91c9d5ce3611d6bcaf1125de3afcaaf95f168b194acd4094b42065e2866058ea56865a5203a3
-
Filesize
4.4MB
MD5862441f364a53728b197a8869794078a
SHA1ca940c0351fa30691774ab2f4106f5d8513b96af
SHA256ed728f5dde89428e7732fb76022c6c272e56d80d784c097a6dc7747105542d84
SHA51247b822f51031480a697cf492516aa132b79b1b3e57902ea6bb13259f09a4cd78ba0d70c038a09c357d14fe670d683a1b2acf500553da40b8f0c32aee9cd2ed74
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize5.8MB
MD58cb7dc0c09e8e3a2c447e76bbca9d3e7
SHA18e338ae8080f6b644750ff19539132336da95d6b
SHA256a0d8ca77094021907604fc3ccaab5810ce2603b472cc30d7bb39b7fd87830092
SHA5124f821abc624b83edac1b82be5540a5a34a33ee2a25e467c916c34b7f55a70bde04b7a795d4c8f057d48514f4f3fe205bef3d8526b8cc1d3f71751d890583dc26