Analysis
-
max time kernel
30s -
max time network
138s -
platform
windows10_x64 -
resource
win10 -
submitted
06-07-2020 08:58
Static task
static1
Behavioral task
behavioral1
Sample
decoderma@tutanota.com.exe
Resource
win7
Behavioral task
behavioral2
Sample
decoderma@tutanota.com.exe
Resource
win10
General
-
Target
decoderma@tutanota.com.exe
-
Size
998KB
-
MD5
7bc5183b207888e9c01193fe2f1d0976
-
SHA1
e679f69eb28ab3462cc308143d9d372b40d936d1
-
SHA256
9e3d7b2163b865375d1b14a37c9130c55b9de8a6eb74b54f0d6f1a8b820eceae
-
SHA512
ce38603c3e21a716124bc4cc627f3c983685849625ec2cec5a1391eb904a84dff8681204cc3944c73e19c4398ed37fb8658927ed0f953c037afea98eea989aaf
Malware Config
Signatures
-
Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
-
Modifies Windows Firewall 1 TTPs
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
decoderma@tutanota.com.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\NewTrace.tiff decoderma@tutanota.com.exe -
Drops startup file 1 IoCs
Processes:
decoderma@tutanota.com.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini decoderma@tutanota.com.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
Processes:
decoderma@tutanota.com.exedescription ioc process File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Microsoft\Windows\SystemData\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Public\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Music\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\Media\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Public\Downloads\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Public\Music\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Videos\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\Downloaded Program Files\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Program Files\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Searches\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Public\Desktop\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Public\Libraries\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Program Files (x86)\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Public\Pictures\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini decoderma@tutanota.com.exe File created C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Public\Videos\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Public\Documents\desktop.ini decoderma@tutanota.com.exe File created C:\Program Files\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Microsoft\Windows\SystemData\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini decoderma@tutanota.com.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
description flow ioc HTTP URL 2 http://www.sfml-dev.org/ip-provider.php HTTP URL 11 http://www.sfml-dev.org/ip-provider.php HTTP URL 13 http://www.sfml-dev.org/ip-provider.php -
Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 1 IoCs
Processes:
decoderma@tutanota.com.exedescription ioc process File opened for modification C:\Windows\SysWOW64\regedit.exe decoderma@tutanota.com.exe -
Drops file in Program Files directory 64 IoCs
Processes:
decoderma@tutanota.com.exedescription ioc process File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar.[decoderma@tutanota.com][ID-KPXMGBYN4WZJ395].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png decoderma@tutanota.com.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libwall_plugin.dll decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Content\holoLens\en-US\doc_offline_use.xml decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_ja.jar.[decoderma@tutanota.com][ID-KPXMGBYN4WZJ395].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\mmsogdiplusim.dll decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\PilotshubApp.exe decoderma@tutanota.com.exe File opened for modification C:\Program Files\Common Files\System\DirectDB.dll decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\FPSRVUTL.DLL decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubMedTile.scale-100_contrast-white.png decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-crt-multibyte-l1-1-0.dll.[decoderma@tutanota.com][ID-KPXMGBYN4WZJ395].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\Xusage.txt decoderma@tutanota.com.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo decoderma@tutanota.com.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-ae\ui-strings.js decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\lobby_deck_style_beach.png decoderma@tutanota.com.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.[decoderma@tutanota.com][ID-KPXMGBYN4WZJ395].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\6536_20x20x32.png decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-16.png decoderma@tutanota.com.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\PNG32.FLT.[decoderma@tutanota.com][ID-KPXMGBYN4WZJ395].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\Assets\Images\Tiles\Square150x150Logo.scale-200.png decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Workflow\Density_Selected_Solid.png decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\xaml\onenote\CaptureThumbnailImageControl.xaml decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Excel.dll.[decoderma@tutanota.com][ID-KPXMGBYN4WZJ395].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\logo.png decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\CalculatorApp.winmd decoderma@tutanota.com.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-hk_get.svg decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.[decoderma@tutanota.com][ID-KPXMGBYN4WZJ395].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-80.png decoderma@tutanota.com.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt.[decoderma@tutanota.com][ID-KPXMGBYN4WZJ395].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dt_shmem.dll decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaBrightDemiItalic.ttf decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\README.txt.[decoderma@tutanota.com][ID-KPXMGBYN4WZJ395].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\XMLOffKeys\Keys_OffVer11.xml decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-20_altform-unplated_contrast-black.png decoderma@tutanota.com.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\ui-strings.js decoderma@tutanota.com.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.[decoderma@tutanota.com][ID-KPXMGBYN4WZJ395].Void decoderma@tutanota.com.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe.[decoderma@tutanota.com][ID-KPXMGBYN4WZJ395].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\DailyChallenges\LargeTriPeaksTile.jpg decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\AppxManifest.xml decoderma@tutanota.com.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.[decoderma@tutanota.com][ID-KPXMGBYN4WZJ395].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar.[decoderma@tutanota.com][ID-KPXMGBYN4WZJ395].Void decoderma@tutanota.com.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML.[decoderma@tutanota.com][ID-KPXMGBYN4WZJ395].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\hug.png decoderma@tutanota.com.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.[decoderma@tutanota.com][ID-KPXMGBYN4WZJ395].Void decoderma@tutanota.com.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.[decoderma@tutanota.com][ID-KPXMGBYN4WZJ395].Void decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookMedTile.scale-150.png decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5666_40x40x32.png decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsMedTile.scale-200.png decoderma@tutanota.com.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-Bold.otf decoderma@tutanota.com.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar decoderma@tutanota.com.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\msolap_xl.dll decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\6440_72x72x32.png decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSplashLogo.scale-300.png decoderma@tutanota.com.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OneConnectAppList.targetsize-256.png decoderma@tutanota.com.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\ui-strings.js decoderma@tutanota.com.exe -
Drops file in Windows directory 64 IoCs
Processes:
decoderma@tutanota.com.exedescription ioc process File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\WideTile.scale-200_contrast-white.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_altform-unplated_contrast-black.png decoderma@tutanota.com.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFramework.Classic\3.0.0.0__31bf3856ad364e35\PresentationFramework.Classic.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\Help\Windows\IndexStore\en-US\art.mshi decoderma@tutanota.com.exe File opened for modification C:\Windows\INF\wvmic_ext.inf decoderma@tutanota.com.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\nppdf32.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\diagnostics\system\Apps\VF_WSReset.ps1 decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Microsoft.People.Controls.winmd decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\MainPage\silverIcon.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\mso98imm.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\en-us\wintlim.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\Lumia.ViewerPlugin\Assets\IconOpenInCinemagraph.contrast-high_scale-100.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.scale-200.png decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\WebAdminHelp.aspx decoderma@tutanota.com.exe File opened for modification C:\Windows\INF\.NET CLR Networking 4.0.0.0\_Networkingperfcounters.ini decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80_altform-unplated.png decoderma@tutanota.com.exe File opened for modification C:\Windows\Media\Windows Proximity Notification.wav decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Content\surfaceHub\en-US\doc_offline_getconnected.xml decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\SmallTile.scale-125.png decoderma@tutanota.com.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100cht_x64 decoderma@tutanota.com.exe File opened for modification C:\Windows\INF\termmou.PNF decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GameEnd\endGame_blue_down.png decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Text.Encoding.Extensions.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteWideTile.scale-100.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\ClrCompression.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe.manifest decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Applications\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.Tile.winmd decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-60.png decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.StarClub\Assets\Animation\crown_sparking.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\pk_16x11.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Aquarium\aquarium_11c.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNotePageWideTile.scale-100.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Google.scale-125.png decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Policy.3.0.Microsoft.BackgroundIntelligentTransfer.Management\v4.0_10.0.0.0__31bf3856ad364e35\Policy.3.0.Microsoft.BackgroundIntelligentTransfer.Management.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W69ef49d2#\3cdfe6d988b300b9272f3ad743b8c7fa\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\diagnostics\system\Device\RS_DriverNotFound.ps1 decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\starttile.dualsim1.surprise.scale-200.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-24.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-white_scale-100.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Toolkit\Images\dash.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Office\BooleanIntersect.scale-100.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Resources\GetSMDL2.ttf decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_BadgeLogo.scale-100.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Microsoft.Xaml.Interactions.winmd decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\SkypeApp\Assets\LockScreenBadgeLogo.scale-100.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7316_40x40x32.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsWideTile.scale-100.png decoderma@tutanota.com.exe File opened for modification C:\Windows\diagnostics\scheduled\Maintenance\CL_Utility.ps1 decoderma@tutanota.com.exe File opened for modification C:\Windows\diagnostics\system\Bluetooth\DiagPackage.diagpkg decoderma@tutanota.com.exe File opened for modification C:\Windows\INF\mrvlpcie8897.inf decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe.config decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionSmallTile.scale-150.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-150.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\ExchangeMediumTile.scale-100.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\1937_40x40x32.png decoderma@tutanota.com.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailMediumTile.scale-125.png decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\v4.0_10.0.15063.0__31bf3856ad364e35\Policy.1.0.Microsoft.Interop.Security.AzRoles.dll decoderma@tutanota.com.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\home1.aspx decoderma@tutanota.com.exe -
NTFS ADS 51 IoCs
Processes:
decoderma@tutanota.com.exedescription ioc process File opened for modification C:\Documents and Settings\zh-TW\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Application Data\Setup\隚瓨闎瓨6-\:쀀隚瓨懈ƍ憰ƍ闎瓨[d\隚瓨慨ƍ慐ƍ闎瓨\3쀀隚瓨擨ƍ擐ƍ闎瓨Ȍí\隚瓨戨ƍ成ƍ闎瓨\3쀀隚瓨拈ƍ抰ƍ闎瓨Ȥí\隚瓨拨ƍ拐ƍ闎瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Application Data\Roaming\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\Default\Application Data\Roaming\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Documents\Setup\"쀀隚瓨ꆰƊꂐƊ闎瓨7A\隚瓨랠Ɗ랈Ɗ闎瓨i\:쀀隚瓨뜠Ɗ뜈Ɗ闎瓨\隚瓨띀Ɗ뜨Ɗ闎瓨Ą decoderma@tutanota.com.exe File opened for modification C:\Users\Default\Documents\My Videos\閳瓨జƆ\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨Ɓ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Application Data\Setup\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\History\Chrome\"쀀隚瓨ƑƑ闎瓨\隚瓨鴈ǜ鳰ǜ闎瓨Cd\:쀀隚瓨麈ǜ鹰ǜ闎瓨Ru\隚瓨鳨ǜ鳐ǜ闎瓨-0\3쀀隚瓨鴨ǜ鴐ǜ闎瓨\隚瓨鸨ǜ鸐ǜ闎瓨옼ɢ\3쀀隚瓨鹈ǜ鸰ǜ闎瓨\隚瓨鵈ǜ鴰ǜ闎瓨\3쀀隚瓨鵨ǜ鵐ǜ闎瓨\隚瓨鶈ǜ鵰ǜ闎瓨Ą decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Application Data\Roaming\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蚌Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蚬Ƅ decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Application Data\Roaming\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀o\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Documents\Setup\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ虬Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\߿\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨Ɓ\3쀀隚瓨\ʄƄ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蚌Ƅ\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Desktop\Setup\"쀀隚瓨ꆰƊꁸƊ闎瓨7A\隚瓨뛀Ɗ뚨Ɗ闎瓨i\:쀀隚瓨럀Ɗ램Ɗ闎瓨\隚瓨뜀Ɗ뛨Ɗ闎瓨Ą decoderma@tutanota.com.exe File opened for modification C:\Users\Default\AppData\Local\History\臤ƈ潰Ɗ潀Ɗ闎瓨\"쀀隚瓨Ῠƍᾈƍ闎瓨㚰惉\隚瓨呐ƅ吸ƅ闎瓨\:쀀隚瓨啐ƅ唸ƅ闎瓨\隚瓨劰ƅ劘ƅ闎瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Application Data\Color\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蚸Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ʌƄ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Application Data\Color\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\ÀƄ虬Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\History\Chrome\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\߿\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\Default\AppData\Local\Application Data\閳瓨జƆ\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\Default\Documents\My Music\閳瓨艤ƈ\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蚌Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蛬Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\Default\Documents\My Videos\閳瓨ᄜƆ雸ƈ镸ƈ闎瓨Inά\隚瓨깈Ɗ기Ɗ闎瓨 E\:쀀隚瓨吰ƅ吘ƅ闎瓨\隚瓨匰ƅ匘ƅ闎瓨\3쀀隚瓨咰ƅ咘ƅ闎瓨\隚瓨印ƅ単ƅ闎瓨Po\3쀀隚瓨啐ƅ唸ƅ闎瓨\隚瓨刐ƅ凸ƅ闎瓨Ą decoderma@tutanota.com.exe File opened for modification C:\Users\Default\Documents\My Pictures\閳瓨ᄜƆ雸ƈ镸ƈ闎瓨Inά\隚瓨깈Ɗ긘Ɗ闎瓨 E\:쀀隚瓨ƓƓ闎瓨\隚瓨咰ƅ咘ƅ闎瓨 decoderma@tutanota.com.exe File opened for modification C:\Documents and Settings\zh-TW\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\蛬Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Desktop\Setup\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蚌Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Documents\Setup\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Microsoft\Windows Defender Advanced Threat Protection\Cache\閳瓨Ɔ\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\Default\Application Data\Roaming\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Microsoft\Windows Defender Advanced Threat Protection\Cache\閳瓨莤ƈ\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\Default\Documents\My Music\閳瓨ᄜƆ雸ƈ镸ƈ闎瓨Inά\隚瓨깈Ɗ글Ɗ闎瓨 E\:쀀隚瓨ƓƓ闎瓨\隚瓨ƓƓ闎瓨\3쀀隚瓨ƓƓ闎瓨we\隚瓨ƓƓ闎瓨Po\3쀀隚瓨ƓƓ闎瓨\隚瓨ƓƓ闎瓨Ą decoderma@tutanota.com.exe File opened for modification C:\System Volume Information\WindowsRE\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\Application Data\Color\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蚌Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ʐƄ decoderma@tutanota.com.exe File opened for modification C:\System Volume Information\WindowsRE\"쀀隚瓨闎瓨l\隚瓨鴈ǜ鳰ǜ闎瓨\:쀀隚瓨鵈ǜ鴰ǜ闎瓨Ǡí\隚瓨鶈ǜ鵰ǜ闎瓨me\3쀀隚瓨鴨ǜ鴐ǜ闎瓨\隚瓨鳨ǜ鳐ǜ闎瓨휌ɢ decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\Application Data\Roaming\"쀀隚瓨ថƈᖀƈ闎瓨in\隚瓨熨Ƒ熐Ƒ闎瓨te\:쀀隚瓨熈Ƒ煰Ƒ闎瓨\隚瓨炨Ƒ炐Ƒ闎瓨.A\3쀀隚瓨烨Ƒ烐Ƒ闎瓨\隚瓨吐ƅ司ƅ闎瓨\3쀀隚瓨匰ƅ匘ƅ闎瓨Ȑí\隚瓨咰ƅ咘ƅ闎瓨a- decoderma@tutanota.com.exe File opened for modification C:\Users\Default\AppData\Local\Application Data\閳瓨Ɔ\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨Ɓ\3쀀_\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\Default\AppData\Local\History\閳瓨Ɔ\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ虬Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨Ɓ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Desktop\Setup\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ʐƄ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蚌Ƅ\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Desktop\Setup\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蚌Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Desktop\Setup\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\Default\Cookies\Roaming\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蚌Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蚌Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蚌Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\߿\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\Default\Application Data\Roaming\"쀀隚瓨雸ƈ锰ƈ闎瓨In\隚瓨ƓƓ闎瓨 E\:쀀隚瓨ƓƓ闎瓨\隚瓨ƓƓ闎瓨\3쀀隚瓨啐ƅ唸ƅ闎瓨we\隚瓨叐ƅ厸ƅ闎瓨Po\3쀀隚瓨劰ƅ劘ƅ闎瓨\隚瓨咰ƅ咘ƅ闎瓨Ą\3쀀隚瓨呰ƅ员ƅ闎瓨Ȱí\隚瓨剐ƅ券ƅ闎瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\Default\Cookies\Roaming\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蛬Ƅ\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Application Data\Setup\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\߿\ÀƄ蚌Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Documents and Settings\zh-TW\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Application Data\Setup\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ʐƄ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Application Data\Setup\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ʐƄ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨Ɓ decoderma@tutanota.com.exe File opened for modification C:\System Volume Information\WindowsRE\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蚌Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\Admin\AppData\Local\History\Chrome\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ʈƄ\3쀀隚瓨\3쀀隚瓨\߿\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Documents\Setup\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ虸Ƅ\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Desktop\Setup\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\߿\3쀀隚瓨\ÀƄ蜜Ƅ\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Application Data\Setup\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蚌Ƅ\3쀀隚瓨\ÀƄ蚌Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蚌Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\ÀƄ蚔Ƅ\3쀀隚瓨\ÀƄ蚼Ƅ\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\߿\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Application Data\Setup\"쀀隚瓨ꆰƊꁠƊ闎瓨7A\隚瓨례Ɗ련Ɗ闎瓨i\:쀀隚瓨론Ɗ롈Ɗ闎瓨\隚瓨뜀Ɗ뛨Ɗ闎瓨Ą\3쀀隚瓨띠Ɗ띈Ɗ闎瓨\隚瓨랠Ɗ랈Ɗ闎瓨 decoderma@tutanota.com.exe File opened for modification C:\ProgramData\Documents\Setup\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe File opened for modification C:\Users\All Users\Application Data\Setup\"쀀隚瓨\:쀀隚瓨\:쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨\3쀀隚瓨 decoderma@tutanota.com.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
decoderma@tutanota.com.exepid process 3100 decoderma@tutanota.com.exe 3100 decoderma@tutanota.com.exe 3100 decoderma@tutanota.com.exe 3100 decoderma@tutanota.com.exe 3100 decoderma@tutanota.com.exe 3100 decoderma@tutanota.com.exe 3100 decoderma@tutanota.com.exe 3100 decoderma@tutanota.com.exe 3100 decoderma@tutanota.com.exe 3100 decoderma@tutanota.com.exe 3100 decoderma@tutanota.com.exe 3100 decoderma@tutanota.com.exe 3100 decoderma@tutanota.com.exe 3100 decoderma@tutanota.com.exe 3100 decoderma@tutanota.com.exe 3100 decoderma@tutanota.com.exe 3100 decoderma@tutanota.com.exe 3100 decoderma@tutanota.com.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
decoderma@tutanota.com.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.exedescription pid process target process PID 3100 wrote to memory of 3292 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3292 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3292 3100 decoderma@tutanota.com.exe cmd.exe PID 3292 wrote to memory of 3384 3292 cmd.exe net.exe PID 3292 wrote to memory of 3384 3292 cmd.exe net.exe PID 3292 wrote to memory of 3384 3292 cmd.exe net.exe PID 3384 wrote to memory of 3276 3384 net.exe net1.exe PID 3384 wrote to memory of 3276 3384 net.exe net1.exe PID 3384 wrote to memory of 3276 3384 net.exe net1.exe PID 3100 wrote to memory of 3928 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3928 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3928 3100 decoderma@tutanota.com.exe cmd.exe PID 3928 wrote to memory of 3448 3928 cmd.exe net.exe PID 3928 wrote to memory of 3448 3928 cmd.exe net.exe PID 3928 wrote to memory of 3448 3928 cmd.exe net.exe PID 3448 wrote to memory of 3504 3448 net.exe net1.exe PID 3448 wrote to memory of 3504 3448 net.exe net1.exe PID 3448 wrote to memory of 3504 3448 net.exe net1.exe PID 3100 wrote to memory of 3584 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3584 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3584 3100 decoderma@tutanota.com.exe cmd.exe PID 3584 wrote to memory of 2600 3584 cmd.exe net.exe PID 3584 wrote to memory of 2600 3584 cmd.exe net.exe PID 3584 wrote to memory of 2600 3584 cmd.exe net.exe PID 2600 wrote to memory of 3016 2600 net.exe net1.exe PID 2600 wrote to memory of 3016 2600 net.exe net1.exe PID 2600 wrote to memory of 3016 2600 net.exe net1.exe PID 3100 wrote to memory of 3612 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3612 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3612 3100 decoderma@tutanota.com.exe cmd.exe PID 3612 wrote to memory of 3668 3612 cmd.exe net.exe PID 3612 wrote to memory of 3668 3612 cmd.exe net.exe PID 3612 wrote to memory of 3668 3612 cmd.exe net.exe PID 3668 wrote to memory of 3008 3668 net.exe net1.exe PID 3668 wrote to memory of 3008 3668 net.exe net1.exe PID 3668 wrote to memory of 3008 3668 net.exe net1.exe PID 3100 wrote to memory of 2096 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 2096 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 2096 3100 decoderma@tutanota.com.exe cmd.exe PID 2096 wrote to memory of 2164 2096 cmd.exe net.exe PID 2096 wrote to memory of 2164 2096 cmd.exe net.exe PID 2096 wrote to memory of 2164 2096 cmd.exe net.exe PID 2164 wrote to memory of 392 2164 net.exe net1.exe PID 2164 wrote to memory of 392 2164 net.exe net1.exe PID 2164 wrote to memory of 392 2164 net.exe net1.exe PID 3100 wrote to memory of 3800 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3800 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3800 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3836 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3836 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3836 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3384 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3384 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3384 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3796 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3796 3100 decoderma@tutanota.com.exe cmd.exe PID 3100 wrote to memory of 3796 3100 decoderma@tutanota.com.exe cmd.exe PID 3796 wrote to memory of 1812 3796 cmd.exe net.exe PID 3796 wrote to memory of 1812 3796 cmd.exe net.exe PID 3796 wrote to memory of 1812 3796 cmd.exe net.exe PID 1812 wrote to memory of 3600 1812 net.exe net1.exe PID 1812 wrote to memory of 3600 1812 net.exe net1.exe PID 1812 wrote to memory of 3600 1812 net.exe net1.exe PID 3100 wrote to memory of 1608 3100 decoderma@tutanota.com.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\decoderma@tutanota.com.exe"C:\Users\Admin\AppData\Local\Temp\decoderma@tutanota.com.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLWriter2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLBrowser2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$CONTOSO13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$CONTOSO14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSDTC2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MSDTC3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSDTC4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop vds2⤵
-
C:\Windows\SysWOW64\net.exenet stop vds3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vds4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set currentprofile state off3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/392-14-0x0000000000000000-mapping.dmp
-
memory/1608-21-0x0000000000000000-mapping.dmp
-
memory/1768-23-0x0000000000000000-mapping.dmp
-
memory/1812-19-0x0000000000000000-mapping.dmp
-
memory/2064-28-0x0000000000000000-mapping.dmp
-
memory/2096-12-0x0000000000000000-mapping.dmp
-
memory/2164-13-0x0000000000000000-mapping.dmp
-
memory/2268-25-0x0000000000000000-mapping.dmp
-
memory/2596-22-0x0000000000000000-mapping.dmp
-
memory/2600-7-0x0000000000000000-mapping.dmp
-
memory/2640-26-0x0000000000000000-mapping.dmp
-
memory/3008-11-0x0000000000000000-mapping.dmp
-
memory/3016-8-0x0000000000000000-mapping.dmp
-
memory/3100-35-0x0000000001EF0000-0x0000000001EF1000-memory.dmpFilesize
4KB
-
memory/3100-36-0x00000000026F0000-0x00000000026F1000-memory.dmpFilesize
4KB
-
memory/3100-32-0x00000000026F0000-0x00000000026F1000-memory.dmpFilesize
4KB
-
memory/3100-31-0x0000000001EF0000-0x0000000001EF1000-memory.dmpFilesize
4KB
-
memory/3100-33-0x0000000001EF0000-0x0000000001EF1000-memory.dmpFilesize
4KB
-
memory/3100-34-0x00000000026F0000-0x00000000026F1000-memory.dmpFilesize
4KB
-
memory/3100-48-0x00000000026F0000-0x00000000026F1000-memory.dmpFilesize
4KB
-
memory/3164-24-0x0000000000000000-mapping.dmp
-
memory/3276-2-0x0000000000000000-mapping.dmp
-
memory/3292-0-0x0000000000000000-mapping.dmp
-
memory/3384-1-0x0000000000000000-mapping.dmp
-
memory/3384-17-0x0000000000000000-mapping.dmp
-
memory/3448-4-0x0000000000000000-mapping.dmp
-
memory/3504-5-0x0000000000000000-mapping.dmp
-
memory/3584-6-0x0000000000000000-mapping.dmp
-
memory/3600-20-0x0000000000000000-mapping.dmp
-
memory/3612-9-0x0000000000000000-mapping.dmp
-
memory/3668-10-0x0000000000000000-mapping.dmp
-
memory/3740-29-0x0000000000000000-mapping.dmp
-
memory/3796-18-0x0000000000000000-mapping.dmp
-
memory/3800-15-0x0000000000000000-mapping.dmp
-
memory/3836-16-0x0000000000000000-mapping.dmp
-
memory/3928-3-0x0000000000000000-mapping.dmp
-
memory/3932-30-0x0000000000000000-mapping.dmp
-
memory/3984-27-0x0000000000000000-mapping.dmp