Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
23/12/2021, 23:36
Static task
static1
Behavioral task
behavioral1
Sample
39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe
-
Size
51KB
-
MD5
e4e439fc5ade188ba2c69367ba6731b6
-
SHA1
d4b3b403b95d50a2feefa046441600e488b941f4
-
SHA256
39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde
-
SHA512
068d7ba1563bf528520a5106a99245896578ac88b0a3263383cdae8657403deba659c06f429dd83710d1f5afa324a49254dd68911382db71810f98a498e901e7
Score
10/10
Malware Config
Extracted
Path
C:\read-me.txt
Family
globeimposter
Ransom Note
All your files are Encrypted!
For data recovery needs decryptor.
How to buy decryptor:
----------------------------------------------------------------------------------------
| 1. Download Tor browser - https://www.torproject.org/ and install it.
| 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV
| 3. Create Ticket
----------------------------------------------------------------------------------------
Note! This link is available via Tor Browser only.
------------------------------------------------------------
or
http://helpqvrg3cc5mvb3.onion/
Your ID
���33 48 AC 6B 5C 95 FD 38 B9 76 7C 46 9E 00 7E E7
CE 88 4C 5A C4 92 DA 43 F8 81 FE 6E 43 DC 43 8A
2E 34 0C 28 86 0E 0E 94 69 62 9C F3 74 E3 F1 C8
AB 8A BA 00 4F F4 13 22 C2 1C D1 5F D3 BA 65 86
9B C2 BA 60 A2 20 48 57 BF 2B 18 49 79 53 B3 6A
63 0C 19 72 12 C8 20 21 B3 55 5B 17 B3 57 F2 E9
74 83 AE 3F C1 3B 18 EC 21 F4 08 C2 35 2D A2 33
0E B9 1B 56 50 4B AB 96 0F A8 D6 3A A5 B7 77 46
EF CA 08 7A 27 A0 76 52 5A 54 78 73 11 45 52 3A
3C E1 CD E9 00 41 99 2B 16 7D 48 75 48 73 A1 E3
54 10 1F 46 A6 A9 16 B1 6A 29 B3 DD 48 7A D4 37
37 41 B9 C9 AE 51 83 4D D1 68 F8 4D 37 E9 52 8D
2E B2 15 C7 50 38 CA 49 F1 70 14 AC 13 16 18 74
34 9D E9 5D 2F 0C B3 77 F1 9A E6 67 6E 75 EA 6F
CE 00 07 6C 89 65 E4 27 D1 6A 12 00 7D E8 95 01
E3 CE E8 9C 6C 38 DD 2B 20 03 FB 51 94 59 70 50
URLs
http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV
http://helpqvrg3cc5mvb3.onion/
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ConnectExit.tiff 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File renamed C:\Users\Admin\Pictures\ConnectExit.tiff => C:\Users\Admin\Pictures\ConnectExit.tiff.xls 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File renamed C:\Users\Admin\Pictures\MoveSuspend.raw => C:\Users\Admin\Pictures\MoveSuspend.raw.xls 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File renamed C:\Users\Admin\Pictures\SearchMeasure.raw => C:\Users\Admin\Pictures\SearchMeasure.raw.xls 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File renamed C:\Users\Admin\Pictures\SubmitExpand.raw => C:\Users\Admin\Pictures\SubmitExpand.raw.xls 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 27 IoCs
description ioc Process File opened for modification C:\Users\Admin\OneDrive\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Admin\Links\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Public\Music\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Public\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Public\Videos\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Public\Documents\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Admin\Music\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files (x86)\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\desktop.ini 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\plugins\video_splitter\read-me.txt 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\UpsellFooterBannerDesktop.jpg 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubAppList.scale-125_contrast-black.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\GenericMailBadge.scale-100.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-16.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_listview_selected.svg 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-100.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\MainPageState2\spider_bp_920.jpg 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Audio\dcGoalPopUp_A.wav 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\LICENSE 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\ui-strings.js 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-32_altform-unplated.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsSplashScreen.scale-100.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSmallTile.scale-100.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-16_altform-unplated.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-256_altform-unplated.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\resources.pri 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-200_contrast-white.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\read-me.txt 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\read-me.txt 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover_2x.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-36.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\read-me.txt 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\flavormap.properties 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\StopwatchMedTile.contrast-black_scale-200.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe\AppxBlockMap.xml 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Beach\mask\1h.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\read-me.txt 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\read-me.txt 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\plugin.js 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\read-me.txt 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-40.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6100_40x40x32.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Outlook.scale-125.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionSmallTile.scale-400.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\EmbossBitmaps\Rectangle.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-72.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\Images\win_logo_white.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\Weather_LogoSmall.scale-100.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\ui-strings.js 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\ui-strings.js 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\ui-strings.js 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.scale-100.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\j2pkcs11.dll 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluDCFilesEmpty_180x180.svg 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W4.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARA.TTF 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\read-me.txt 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\resources.pri 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\sadsmile.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-80.png 39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe"C:\Users\Admin\AppData\Local\Temp\39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:684