Analysis Overview
SHA256
157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c
Threat Level: Known bad
The file 157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c was found to be: Known bad.
Malicious Activity Summary
GlobeImposter
Modifies extensions of user files
Reads user/profile data of web browsers
Adds Run key to start application
Drops desktop.ini file(s)
Drops file in Program Files directory
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-03-05 18:39
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-03-05 18:39
Reported
2022-03-05 18:42
Platform
win7-en-20211208
Max time kernel
151s
Max time network
125s
Command Line
Signatures
GlobeImposter
Modifies extensions of user files
| Description | Indicator | Process | Target |
| File renamed | C:\Users\Admin\Pictures\ExpandImport.crw => C:\Users\Admin\Pictures\ExpandImport.crw.crypt | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\ExportUnblock.png => C:\Users\Admin\Pictures\ExportUnblock.png.crypt | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\MergeReset.crw => C:\Users\Admin\Pictures\MergeReset.crw.crypt | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\ProtectEnable.png => C:\Users\Admin\Pictures\ProtectEnable.png.crypt | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\SetMove.png => C:\Users\Admin\Pictures\SetMove.png.crypt | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\SkipBackup.tif => C:\Users\Admin\Pictures\SkipBackup.tif.crypt | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\CopyCheckpoint.raw => C:\Users\Admin\Pictures\CopyCheckpoint.raw.crypt | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\DenyAssert.crw => C:\Users\Admin\Pictures\DenyAssert.crw.crypt | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe" | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
Drops desktop.ini file(s)
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Stationery\1033\PAWPRINT.HTM | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\TWSTRUCT.DLL | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.MY.XML | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0297551.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABELHM.POC | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01058_.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OutSyncPC.ico | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_K_COL.HXK | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239965.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL065.XML | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_hyperlink.gif | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24ImagesMask.bmp | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Essential.xml | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR32F.GIF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01618_.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105288.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152722.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0238983.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File created | C:\Program Files (x86)\how_to_back_files.html | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\LAUNCH.GIF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\background.gif | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\TAB_ON.GIF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293240.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Apex.xml | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\TAB_OFF.GIF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImagesMask.bmp | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\GostName.XSL | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101856.BMP | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106208.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\StaticText.jpg | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME15.CSS | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME25.CSS | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\TAB_OFF.GIF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10265_.GIF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Slipstream.xml | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00419_.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0160590.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL077.XML | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left_over.gif | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Dialog.accdt | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\VelvetRose.css | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Templates\1033\QuizShow.potx | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\HEADER.GIF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\HEADER.GIF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15132_.GIF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01138_.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00919_.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART3.BDR | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\BUTTON.GIF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00957_.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File created | C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\how_to_back_files.html | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File created | C:\Program Files (x86)\Microsoft Office\Office14\how_to_back_files.html | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBrowserUpgrade.html | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTORE_COL.HXT | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21413_.GIF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02068_.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107192.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0136865.WMF | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe
"C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe"
Network
Files
memory/1932-55-0x0000000076511000-0x0000000076513000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-03-05 18:39
Reported
2022-03-05 18:42
Platform
win10v2004-en-20220112
Max time kernel
152s
Max time network
153s
Command Line
Signatures
GlobeImposter
Modifies extensions of user files
| Description | Indicator | Process | Target |
| File renamed | C:\Users\Admin\Pictures\JoinStart.crw => C:\Users\Admin\Pictures\JoinStart.crw.crypt | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\OpenCheckpoint.raw => C:\Users\Admin\Pictures\OpenCheckpoint.raw.crypt | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\RepairEnter.tif => C:\Users\Admin\Pictures\RepairEnter.tif.crypt | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\ResetRead.tif => C:\Users\Admin\Pictures\ResetRead.tif.crypt | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\StartConvertFrom.tif => C:\Users\Admin\Pictures\StartConvertFrom.tif.crypt | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\ClearStart.crw => C:\Users\Admin\Pictures\ClearStart.crw.crypt | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\GroupWatch.png => C:\Users\Admin\Pictures\GroupWatch.png.crypt | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\HideJoin.tif => C:\Users\Admin\Pictures\HideJoin.tif.crypt | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe" | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
Drops desktop.ini file(s)
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-72_altform-unplated.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\x.cur | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_ca.dll | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_altform-unplated_contrast-white.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-100_contrast-white.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\how_to_back_files.html | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_checkbox_unselected_18.svg | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-96_contrast-white.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare71x71Logo.scale-200.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-48.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\skin_beeps.lua | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pt-br\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\main.css | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\MoviesAnywhereLogoWithTextDark.scale-200.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBarTasks.winmd | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main-selector.css | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-fr\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner_dark.gif | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LargeTile.scale-200_contrast-white.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-16_contrast-black.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\how_to_back_files.html | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_close2x.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\it-it\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter_18.svg | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\how_to_back_files.html | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_pt-BR.dll | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\AddRestart.ex_ | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-24_altform-unplated_contrast-black.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-72.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sk-sk\how_to_back_files.html | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\how_to_back_files.html | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\exportpdfupsell-app-tool-view.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-72.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\how_to_back_files.html | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-si\ui-strings.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\share_icons.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black_devicefamily-colorfulunplated.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\en-US\webviewCore.min.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\how_to_back_files.html | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon_hover.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\how_to_back_files.html | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\plugin.js | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\how_to_back_files.html | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\how_to_back_files.html | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\AppxSignature.p7x | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_altform-unplated_contrast-black.png | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\how_to_back_files.html | C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe
"C:\Users\Admin\AppData\Local\Temp\157f9cc11f1c27b326c5bb06d0242249cd080a810c760346b335a5aac3e2662c.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | geo.prod.do.dsp.mp.microsoft.com | udp |
| US | 52.184.212.181:443 | geo.prod.do.dsp.mp.microsoft.com | tcp |
| US | 8.8.8.8:53 | kv801.prod.do.dsp.mp.microsoft.com | udp |
| NL | 184.29.205.60:443 | kv801.prod.do.dsp.mp.microsoft.com | tcp |
| US | 8.8.8.8:53 | cp801.prod.do.dsp.mp.microsoft.com | udp |
| NL | 184.29.205.60:443 | cp801.prod.do.dsp.mp.microsoft.com | tcp |
| NL | 184.29.205.60:443 | cp801.prod.do.dsp.mp.microsoft.com | tcp |