Analysis
-
max time kernel
151s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-06-2022 04:39
Static task
static1
Behavioral task
behavioral1
Sample
13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
-
Size
167KB
-
MD5
612974dcb49adef982d9ad8d9cbdde36
-
SHA1
b817e361bd0cc1819d7f6a1189f0f5d56ed48721
-
SHA256
13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920
-
SHA512
84d5acbb8f258683bb6735539e368c2823218d2a6cf07222a50e1e026e3a0aca092941110e87b1d38a601c6a1e3d54604c2f4241c3ec265ed0bf25140a14c2fc
Score
10/10
Malware Config
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SendConvertTo.tif => C:\Users\Admin\Pictures\SendConvertTo.tif..doc 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File renamed C:\Users\Admin\Pictures\RegisterSkip.png => C:\Users\Admin\Pictures\RegisterSkip.png..doc 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Admin\Pictures\RemoveWrite.tiff 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File renamed C:\Users\Admin\Pictures\SearchTrace.raw => C:\Users\Admin\Pictures\SearchTrace.raw..doc 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Admin\Pictures\SearchWatch.tiff 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File renamed C:\Users\Admin\Pictures\SearchWatch.tiff => C:\Users\Admin\Pictures\SearchWatch.tiff..doc 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File renamed C:\Users\Admin\Pictures\MeasureLock.crw => C:\Users\Admin\Pictures\MeasureLock.crw..doc 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File renamed C:\Users\Admin\Pictures\MountRemove.crw => C:\Users\Admin\Pictures\MountRemove.crw..doc 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File renamed C:\Users\Admin\Pictures\RemoveWrite.tiff => C:\Users\Admin\Pictures\RemoveWrite.tiff..doc 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Roaming\\13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe" 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe -
Drops desktop.ini file(s) 28 IoCs
description ioc Process File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Public\Videos\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Admin\Music\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Public\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Admin\Links\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Public\Documents\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Public\Music\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7cm_en.dub 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\APA.XSL 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00262_.WMF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ.DLL 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\MINUS.GIF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left.gif 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00121_.WMF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\ARROW.WAV 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIDEBARBB.DPV 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\LASER.WAV 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CONTACTS.ICO 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\Read___ME.html 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Northwind.accdt 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RSSITEM.CFG 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MOR6INT.DLL 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10301_.GIF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Sales Pipeline.accdt 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Adjacency.eftx 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay.css 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\SHOT.WAV 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\TAB_ON.GIF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21398_.GIF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL058.XML 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN010.XML 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\Read___ME.html 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR30B.GIF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\TAB_OFF.GIF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21316_.GIF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME37.CSS 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKDEC.CFG 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15019_.GIF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18215_.WMF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\MessageBoxIconImages.jpg 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0090386.WMF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0186002.WMF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\SETLANG_F_COL.HXK 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\PublicFunctions.js 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\PABR.SAM 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Casual.css 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18218_.WMF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Messenger.xml 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEIRM.XML 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL111.XML 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ENGDIC.DAT 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\GIGGLE.WAV 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RESENDS.ICO 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15059_.GIF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\TAB_ON.GIF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18238_.WMF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCAL.XML 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\MSGR3FR.DLL 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR3F.GIF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME50.CSS 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21339_.GIF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21376_.GIF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18205_.WMF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR3F.GIF 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN108.XML 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\utilityfunctions.js 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\1100.accdt 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Settings.zip 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 860 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe"C:\Users\Admin\AppData\Local\Temp\13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:860