Analysis
-
max time kernel
180s -
max time network
145s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11-02-2022 06:43
Static task
static1
Behavioral task
behavioral1
Sample
8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe
-
Size
54KB
-
MD5
b5204963231f9bddba42e611c9f09400
-
SHA1
018166da7dce248f8a9104fa4a5f2dc20038c0e7
-
SHA256
8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711
-
SHA512
ec9de09cc2b83e4446d6954f8e220296b70ca3a0fb5b1e7ee01e949199dc0276413550c5adfd01ff0dd4ede7ad0bb1b24948831610a502acb35096609598eecd
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #4A83FD;
}
.tabs1 .identi {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>���������������B4 99 DC 42 E4 5B B2 90 CC 57 BD D2 C3 CA 35 2A
08 A8 3F 35 F5 3A F2 91 42 A0 4B E3 C2 5B 32 3E
6E C5 98 94 AC B5 D8 4B DE EE D6 08 BF D2 96 FB
36 C2 DE E3 DB B4 2C EA 2D 7A 06 7E 5D 66 0E CF
3A E9 1D 60 F0 66 B2 CE 26 EB FB 15 1C 75 EF 58
18 EB E9 4E 0A 40 76 29 50 A8 F1 01 55 5E 43 58
B4 31 D1 DD E0 F4 97 E0 43 29 34 E5 E3 92 E6 4A
8F 0C 17 40 C0 F1 D7 56 85 14 6E C1 09 7B A3 D4
2B 57 51 D4 69 02 E1 7F D7 C8 34 91 E2 18 75 4B
A6 C9 58 DF 7D 79 67 00 61 72 0B AF 8C 9A 27 E4
64 FB 93 DB 40 93 9C 3F AE 56 4C 34 47 0E 96 36
84 CC 17 2B 0C 4F 9D D2 6B 67 BC 0F C8 4A 5A 50
3D E4 76 BF 0B A6 17 94 25 F0 CB A0 D7 EC 17 48
44 78 7D B5 CD B6 F7 20 13 B6 ED 3E BD 14 E1 47
DA 67 BA 24 56 27 91 C3 B7 94 97 E6 66 52 73 FC
FE 1A 36 DA 48 01 26 FA 24 DF 43 A9 AD 6B CF 9D
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☠ Your files are encrypted! ☠</h1>
<hr/>
<h3>All your important data has been encrypted.
</h3>Don't worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files
.
<br/>
<div class="text">
<!--text data -->
To recover data you need decryptor.</br>
To get the decryptor you should:</br>
·Register email box to protonmail.com or cock.li (do not waste time sending letters from your standard email address, they will all be blocked).
Send a email from your new email address to: [email protected] with your personal ID.
· In response, we will send you further instructions on decrypting your files.
<center>Attention!</center></br>
<ul>
· It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.
· check the folder "Spam" when waiting for an email from us.WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA
ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE
IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY
AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO
NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.
· If we do not respond to your message for more than 12 hours, write to the backup email : [email protected]
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\InstallUnregister.tiff 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Admin\Pictures\ExportSearch.tiff 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe" 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe -
Drops desktop.ini file(s) 27 IoCs
description ioc Process File opened for modification C:\Users\Public\Documents\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Public\Videos\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Public\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Public\Music\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Admin\Links\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Admin\Music\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\TextFile.zip 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Blog.dotx 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianMergeFax.Dotx 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Name.accft 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Payment Type.accft 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Settings.zip 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryLetter.dotx 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BloodPressureTracker.xltx 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CGMIMP32.HLP 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File created C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\how_to_back_files.html 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Comments.accdt 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\SEAMARBL.JPG 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.ICO 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\powerpnt.exe.manifest 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Explorer.zip 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanPhotoAlbum.potx 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Media.accdt 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ENGIDX.DAT 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7fr.kic 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLFLTR.DAT 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\desktop.ini 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyLetter.dotx 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7wre_fr.dub 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\XmlFile.zip 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FiveRules.potx 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\Notebook03.onepkg 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Phone.accft 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\SettingsInternal.zip 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianLetter.Dotx 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\UrbanFax.Dotx 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Charitable Contributions.accdt 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Marketing Projects.accdt 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\1 Right.accdt 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\how_to_back_files.html 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File created C:\Program Files (x86)\Microsoft Office\Stationery\1033\how_to_back_files.html 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\DADSHIRT.HTM 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ASCIIENG.LNG 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.TLB 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\how_to_back_files.html 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialMergeLetter.dotx 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianResume.Dotx 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\PINELUMB.JPG 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Installed_resources14.xss 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ACCSBAR.POC 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityMergeLetter.Dotx 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityResume.Dotx 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Pitchbook.potx 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Issues.accdt 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSEvents.man 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACC.OLB 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUTL.OLB 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryNewsletter.dotx 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\List.accdt 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Tabs.accdt 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.JPG 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPPT.OLB 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\OFFISUPP.HTM 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SegoeChess.ttf 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\how_to_back_files.html 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfo.zip 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\WidescreenPresentation.potx 8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe"C:\Users\Admin\AppData\Local\Temp\8cbb405174fb7ae4cbbfefd934e5396feddd33cfdaed075ce439cc82b710c711.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1680