Analysis
-
max time kernel
153s -
max time network
140s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11-02-2022 07:02
Static task
static1
Behavioral task
behavioral1
Sample
3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe
-
Size
51KB
-
MD5
8c9419abb792b2a6d5220533fb221218
-
SHA1
34cf072cec588286ce5e13baf350239ead5ace8e
-
SHA256
3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9
-
SHA512
3c44fcf8c91f7ef4059e3caebb31d309dec7bb3d8556079f495ccf308cb3f9e588aa1c8f8c705ce92cdf87a2bbc71ab256634950dcbba49474e2a6942e3a9a00
Score
10/10
Malware Config
Extracted
Path
C:\READ THIS.TXT
Ransom Note
Your personal ID :
����������36 B4 01 BC 0A 29 D4 5F C5 38 9C 15 E4 E3 E4 04
B0 6A 7D D1 86 E3 E6 6D B0 FB 63 82 79 3A C0 22
03 63 1F 78 F0 B8 AA F4 A0 3B 57 29 7B CD 76 56
F5 6D 0B B7 B4 5C F5 D2 C1 82 4E F1 EE 9A BF 6A
61 0C 2F 73 DF 89 38 69 B4 6D 2E 84 38 81 BC 0E
90 26 44 A7 04 C4 B9 AC 78 F4 B1 96 F9 BC 77 6B
3B 3A F6 B4 AE 11 6D 4C 3F 70 E4 5D C3 AB DA 12
AA A5 F5 BA 40 2D BA ED 0B F1 E1 9D 73 D2 4F 43
DA B2 E4 88 E3 50 25 AB 94 17 00 81 4C F0 D6 F1
08 2B 2F 34 85 17 F0 F3 67 4F 1E 10 50 28 A6 01
07 75 CD E4 73 C1 3B 07 B8 05 3E 6A DE 3B 14 C3
65 A1 13 E7 B2 3C 04 A9 55 13 5C AB 9C 34 16 9C
9C 37 51 1A 37 B3 12 04 7F 8C 8A 82 21 EA 3F A5
35 6A 53 62 9E 87 D1 15 F1 4A C5 98 2D DB C7 D1
08 A0 7A 12 63 6F EF 67 BD 46 D7 D3 3F 4B 2F 16
8F 2B 0E C4 EE 31 6F 10 13 76 10 A9 83 F3 71 F4
* No data from your computer has been stolen or deleted.
* Follow the instructions to restore the files.
* How to get the automatic decryptor:
1)Contact us by e-mail: [email protected] . In the letter, indicate your personal identifier (look at the beginning of this document)
and the external ip-address of the computer on which the encrypted files are located.
2)After answering your request, our operator will give you further instructions that will show what to do next
(the answer you will receive as soon as possible)
**Send a copy of the letter to Second email address : [email protected]
* Free decryption as guarantee!
Before paying you can send us up to 5 files for free decryption.
The total size of files must be less than 5 Mb (non archived), and files should not contain
valuable information (databases, backups, large excel sheets, etc.).
ATTENTION !!!
* Do not rename encrypted files.
* Do not try to decrypt your data using third party software, it may cause permanent data loss.
* Decryption of your files with the help of third parties may cause increased price
(they add their fee to our) or you can become a victim of a scam.
* If you do not receive a reply within 6 hours, create an account on Gmail.com and try again.
or just check your email spam.���������
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ResumeReceive.tiff 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe" 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe -
Drops desktop.ini file(s) 27 IoCs
description ioc Process File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Public\Documents\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Admin\Music\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Admin\Links\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Public\Videos\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Public\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Public\Music\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\UserControl.zip 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\WidescreenPresentation.potx 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Details.accdt 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADVCMP.DIC 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MAPISHELL.DLL 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\READ THIS.TXT 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\AssemblyInfoInternal.zip 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Custom.propdesc 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EMSMDB32.DLL 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ENGIDX.DAT 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File created C:\Program Files (x86)\MSBuild\READ THIS.TXT 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\Microsoft.VisualStudio.Tools.Applications.AddInManager.dll 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginMergeFax.Dotx 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACEDAO.DLL 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSLaunch.dll 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.Xml.xml 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7en.kic 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\EmptyDatabase.zip 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianMergeFax.Dotx 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GFX.DLL 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieMergeLetter.dotx 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.GIF 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\READ THIS.TXT 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\OFFISUPP.GIF 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianResume.Dotx 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\READ THIS.TXT 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\CURRENCY.HTM 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\DADSHIRT.HTM 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUDIOSEARCHSAPIFE.DLL 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSClient.Msg.dll 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Interface.zip 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\READ THIS.TXT 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDCAT.DLL 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.SemiTrust.xml 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\PAWPRINT.GIF 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CGMIMP32.HLP 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.BusinessData.xml 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Form.zip 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSAutogen.dll 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXSEC32.DLL 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.xml 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\Synchronization.rll 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUDGESCH.HTM 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MAPIPH.DLL 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MIMEDIR.DLL 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\LoginForm.zip 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\CodeFile.zip 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Top.accdt 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.Runtime.dll 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieNewsletter.dotx 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ContemporaryPhotoAlbum.potx 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\TextFile.zip 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanPhotoAlbum.potx 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSStr32.dll 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CharSetTable.chr 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPOLK.DLL 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\READ THIS.TXT 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveResume.dotx 3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe"C:\Users\Admin\AppData\Local\Temp\3a85022db4d1b6e43bbfcb4048ef5b9038eb6a09ce8870516539825a88aa27f9.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1608