Analysis
-
max time kernel
162s -
max time network
131s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11-02-2022 06:30
Static task
static1
Behavioral task
behavioral1
Sample
d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe
-
Size
53KB
-
MD5
21df3a7361edd75cc7a2c13b18fad0ff
-
SHA1
55533fee79b1afeef7fb9030cc6cb45151f29c09
-
SHA256
d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a
-
SHA512
3c118950ba11f85d31e7c94b5d80ef189886c754ce9f3eb3f95fef4e7e231c0c85f744454cf6889fe47e102015bd8b19ae470ee892894744d5ed480fa114d5e0
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">����������3C 7A 5C AA 46 EE 73 C6 B7 7A B4 F7 67 06 01 0D
EC D1 C2 70 47 39 AC ED C6 86 29 4C C6 1E BE 25
BC 0E 11 E5 55 8D B3 5E D9 BA 83 57 BA 16 A0 48
8A F8 54 64 FE D9 CC 61 BA 4A DB F1 A1 59 B8 20
C7 25 0B 00 77 6F 81 9B B8 61 86 3F C0 EE 41 A0
CA F8 B3 C0 1C 25 C7 66 46 E4 98 15 64 96 7F 5E
B2 A1 4D DA D7 9C DA EE 77 93 B4 5C 47 23 A8 4C
05 D1 0F DF 27 51 21 0F 9C 71 A0 A0 31 65 08 E4
35 5F B3 42 AD 0C DA D4 73 85 D9 C6 AD A4 48 67
05 45 71 41 0E 6C 83 45 B7 A7 C2 49 92 39 13 CF
8A 91 BF CA 8F B6 A2 1E 0D FE C3 1C 27 24 BF 24
0F 5F EF 1E 9B 3E 41 00 DB DA 35 D4 C8 7A F9 D9
91 5F 98 F3 78 6A 2A 0B 5B 31 A3 0C B7 99 E1 3D
BB 9B 3F CD 2D 0E 4F DA 64 00 8F 07 A5 FD 60 FB
7E 63 9A 31 C9 A2 38 89 3C 21 BC B4 18 87 E3 C9
CC CC 01 7C ED C7 38 38 AC 8D E6 CF 34 D3 D6 8A
</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
</a><br>
4. Start a chat and follow the further instructions. <br><br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a>
<br><a href="[email protected]">[email protected]</a>
<br>
<b>* To contact us, create a new free email account on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
�����
Emails
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ExpandUnpublish.tif => C:\Users\Admin\Pictures\ExpandUnpublish.tif.marlock14 d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File renamed C:\Users\Admin\Pictures\NewConnect.png => C:\Users\Admin\Pictures\NewConnect.png.marlock14 d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File renamed C:\Users\Admin\Pictures\RequestCopy.png => C:\Users\Admin\Pictures\RequestCopy.png.marlock14 d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File renamed C:\Users\Admin\Pictures\SyncRead.raw => C:\Users\Admin\Pictures\SyncRead.raw.marlock14 d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe" d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe -
Drops desktop.ini file(s) 27 IoCs
description ioc Process File opened for modification C:\Users\Public\Videos\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Public\Pictures\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Public\Downloads\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Admin\Searches\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Admin\Videos\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Admin\Music\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Admin\Links\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Public\Libraries\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Public\Documents\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Public\Desktop\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Public\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Public\Music\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Admin\Documents\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\WidescreenPresentation.potx d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Right.accdt d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.GIF d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Custom.propdesc d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryNewsletter.dotx d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACEDAO.DLL d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.SemiTrust.dll d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSTYLE.DLL d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ogalegit.dll d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialLetter.dotx d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginLetter.Dotx d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Msgbox.accdt d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUDGESCH.GIF d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\PAWPRINT.HTM d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUDIOSEARCHMAIN.DLL d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7.dll d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.Tools.Applications.Project.dll d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveLetter.dotx d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\how_to_back_files.html d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\DADSHIRT.HTM d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CDLMSO.DLL d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EMSMDB32.DLL d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\System.AddIn.dll d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EntityPicker.dll d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEAWSDC.DLL d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BloodPressureTracker.xltx d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialResume.dotx d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\1 Top.accdt d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDCAT.DLL d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.BusinessData.xml d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\how_to_back_files.html d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AppConfig.zip d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OrielLetter.Dotx d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Dialog.accdt d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CharSetTable.chr d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AboutBox.zip d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginMergeFax.Dotx d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Charitable Contributions.accdt d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.Runtime.xml d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\LoanAmortization.xltx d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Interface.zip d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\Notebook03.onepkg d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\how_to_back_files.html d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7fr.kic d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUDIOSEARCHLTS.DLL d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyResume.dotx d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OrielMergeLetter.Dotx d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EMABLT32.DLL d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\VSTAProject.dll d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnvpxy.dll d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\LATIN1.SHP d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MAPISHELL.DLL d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.dll d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7en.kic d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NL7MODELS000C.dll d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityMergeFax.Dotx d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyReport.dotx d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryLetter.dotx d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanPhotoAlbum.potx d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ENVELOPE.DLL d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OART.DLL d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OISAPP.DLL d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\oisctrl.dll d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfo.zip d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe"C:\Users\Admin\AppData\Local\Temp\d32de3b55e2991a3bf1213e43c8193f5d08020bbb03cd03d832191154eb0966a.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:804