Analysis
-
max time kernel
147s -
max time network
135s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11-02-2022 06:58
Static task
static1
Behavioral task
behavioral1
Sample
491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe
Resource
win10v2004-en-20220113
General
-
Target
491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe
-
Size
50KB
-
MD5
656ee1e1c5e105e256835db00b7c6e2d
-
SHA1
6f5340a175ea4b285787b38575a0073cd30af79f
-
SHA256
491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7
-
SHA512
30f22b2fd87e8fee932fc435762d210afb5cec1b694782f874d893da230f838e45e633999a1cc503b68816ca5f811d06685f2c050bf7a2da68eb23bfcbe74806
Malware Config
Extracted
C:\HOW_TO_BACK_FILES.txt
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\GrantAssert.crw => C:\Users\Admin\Pictures\GrantAssert.crw.Goat4444 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Admin\Pictures\SkipPing.tiff 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Admin\Pictures\StartUndo.tiff 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File renamed C:\Users\Admin\Pictures\GroupOut.png => C:\Users\Admin\Pictures\GroupOut.png.Goat4444 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File renamed C:\Users\Admin\Pictures\InitializeSet.raw => C:\Users\Admin\Pictures\InitializeSet.raw.Goat4444 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Admin\Pictures\MeasureDebug.tiff 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File renamed C:\Users\Admin\Pictures\MeasureDebug.tiff => C:\Users\Admin\Pictures\MeasureDebug.tiff.Goat4444 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File renamed C:\Users\Admin\Pictures\SetRegister.raw => C:\Users\Admin\Pictures\SetRegister.raw.Goat4444 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File renamed C:\Users\Admin\Pictures\SkipPing.tiff => C:\Users\Admin\Pictures\SkipPing.tiff.Goat4444 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File renamed C:\Users\Admin\Pictures\StartUndo.tiff => C:\Users\Admin\Pictures\StartUndo.tiff.Goat4444 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File renamed C:\Users\Admin\Pictures\UndoRepair.raw => C:\Users\Admin\Pictures\UndoRepair.raw.Goat4444 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe" 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe -
Drops desktop.ini file(s) 27 IoCs
description ioc Process File opened for modification C:\Users\Public\Desktop\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Admin\Music\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Public\Music\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Public\Documents\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Public\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Public\Videos\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Admin\Links\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanReport.Dotx 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\HOW_TO_BACK_FILES.txt 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXSEC32.DLL 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\UserControl.zip 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityResume.Dotx 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ContactPicker.dll 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\HOW_TO_BACK_FILES.txt 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialLetter.dotx 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ExpenseReport.xltx 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\HOW_TO_BACK_FILES.txt 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanResume.Dotx 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Users.accdt 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Payment Type.accft 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SettingsInternal.zip 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SplashScreen.zip 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\MDIParent.zip 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSLaunch.dll 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\HOW_TO_BACK_FILES.txt 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Category.accft 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSClientManifest.man 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Status.accft 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUTHZAX.DLL 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CSS7DATA000A.DLL 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Explorer.zip 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieResume.dotx 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginResume.Dotx 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\SalesReport.xltx 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Right.accdt 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUDGESCH.GIF 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUDIOSEARCHSAPIFE.DLL 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\Synchronization.rll 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyMergeLetter.dotx 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianLetter.Dotx 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSProxy32.dll 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Class.zip 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieLetter.dotx 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dialog.zip 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\MedianFax.Dotx 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\PINELUMB.HTM 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\HOW_TO_BACK_FILES.txt 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanLetter.Dotx 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\LoginForm.zip 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Module.zip 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Resource.zip 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CSS7DATA0009.DLL 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sqlceca35.dll 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryResume.dotx 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File created C:\Program Files (x86)\Microsoft Office\Stationery\1033\HOW_TO_BACK_FILES.txt 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACEDAO.DLL 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CGMIMP32.HLP 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Tabs.accdt 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Tags.accft 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CSS7DATA000C.DLL 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Form.zip 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\DataSet.zip 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\HOW_TO_BACK_FILES.txt 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CharSetTable.chr 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Dialog.accdt 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GKWord.dll 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Interface.zip 491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe"C:\Users\Admin\AppData\Local\Temp\491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1916