Malware Analysis Report

2024-09-11 01:39

Sample ID 230529-hc9rxsae6v
Target decryptor_575a467c.exe
SHA256 9c9a264f5f1a78753f7f80ee6143d6c8967fa1375821bc09187767756d366800
Tags
agenda ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9c9a264f5f1a78753f7f80ee6143d6c8967fa1375821bc09187767756d366800

Threat Level: Known bad

The file decryptor_575a467c.exe was found to be: Known bad.

Malicious Activity Summary

agenda ransomware spyware stealer

Agenda family

Agenda Ransomware

Drops file in Drivers directory

Loads dropped DLL

Reads user/profile data of web browsers

Drops startup file

Drops desktop.ini file(s)

Drops file in System32 directory

Drops autorun.inf file

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Modifies data under HKEY_USERS

MITRE ATT&CK Matrix V6

Initial Access
TA0001
Replication Through Removable Media
T1091
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Credentials in Files
T1081
Discovery
TA0007
System Information Discovery
T1082
Lateral Movement
TA0008
Replication Through Removable Media
T1091
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040

Analysis: static1

Detonation Overview

Reported

2023-05-29 06:36

Signatures

Agenda family

agenda

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-29 06:36

Reported

2023-05-29 06:39

Platform

win7-20230220-en

Max time kernel

77s

Max time network

30s

Command Line

"C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe"

Signatures

Agenda Ransomware

ransomware agenda

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2647223082-2067913677-935928954-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\cs.txt C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\vi.txt C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\msxactps.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nn.txt C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.sfx C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2032 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe C:\Windows\SysWOW64\WerFault.exe
PID 2032 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe C:\Windows\SysWOW64\WerFault.exe
PID 2032 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe C:\Windows\SysWOW64\WerFault.exe
PID 2032 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe

"C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 840

Network

N/A

Files

memory/2032-54-0x0000000000240000-0x00000000003FE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-29 06:36

Reported

2023-05-29 06:39

Platform

win10v2004-20230220-en

Max time kernel

148s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe"

Signatures

Agenda Ransomware

ransomware agenda

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\gm.dls C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\afunix.sys C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\Downloaded Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\Fonts\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\Web\Wallpaper\Theme2\Desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-1675742406-747946869-1029867430-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\Web\Wallpaper\Theme1\Desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.19041.423_none_7c917c97525f1487\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\it-IT\rdvgumd32.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Storage-VirtualDevice-FibreChannel-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Helium-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-RestrictedCodecsExt-WCOSHeadless-WOW64-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\DriverStore\en-US\whvcrash.inf_loc C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\bda.inf_amd64_d32fe6b1c2b7b2a5\bda.inf C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\adsnt.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Security-SPP-Component-SKU-ServerRdsh-License-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\downlevel\api-ms-win-shcore-stream-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\DriverStore\de-DE\cht4sx64.inf_loc C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\DriverStore\fr-FR\circlass.inf_loc C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\PlayToStatusProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-2-ul-store-rtm.xrm-ms C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_qca9377_1p1_NFA425_olpc_SS_T.bin C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\DriverStore\it-IT\BthOob.inf_loc C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\gpscript.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\ncryptprov.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\UIRibbon.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\mimofcodec.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Holographic-Desktop-Merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1288.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\Dism\de-DE\LogProvider.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\d3d11.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\de-DE\MSFT_ScriptResourceStrings.psd1 C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterUso.Format.ps1xml C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\wavemsp.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\DriverStore\es-ES\netk57a.inf_loc C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\eudcedit.exe.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\g711codc.ax.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\IconCodecService.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\ja-JP\wimgapi.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\DriverStore\fr-FR\vca.inf_loc C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\F12\es-ES\F12Script.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0010~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DataCenterBridging-WOW64-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\DriverStore\en-US\wGenCounter.inf_loc C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_qca9377_1p1_NFA425_olpc_A_TP203NAH.bin C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\DriverStore\ja-JP\EhStorPwdDrv.inf_loc C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\DriverStore\ja-JP\netrtwlanu.inf_loc C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Virtio-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DataCenterBridging-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\DriverStore\it-IT\c_fsreplication.inf_loc C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\DriverStore\ja-JP\wvmic_timesync.inf_loc C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\ja-JP\miutils.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\ucrtbase.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\wbem\WsmAgentUninstall.mof C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\winmsipc.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\DriverStore\es-ES\wvmbusvideo.inf_loc C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\adsnt.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\ja-JP\eventvwr.exe.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-EditionPack-Professional-WOW64-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\pspluginwkr.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkConnectivityStatus\MSFT_NCSIPolicyConfiguration.cdxml C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PhotoBasic-Feature-WOW64-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\wbem\fr-FR\wininit.mfl C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Multimedia-MFPMP-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\downlevel\api-ms-win-core-registry-l2-1-0.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\schtasks.exe.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\msvcp140_clr0400.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\SessEnv.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SimpleTCP-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-OneDrive-Setup-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\occache.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SysWOW64\msdadiag.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\xusb22.inf_amd64_d0f2fd4c931f4672\xusb22.inf C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_retina.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\instrument.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\jvm.lib C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageMedTile.scale-150_contrast-black.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_contrast-black.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-100.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\zx______.pfm C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vreg\excel.x-none.msi.16.x-none.vreg.dat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\TecProxy.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-core-timezone-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_filter_18.svg C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\WebviewOffline.html C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptySearch.scale-150.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.Telemetry\BIEvents.xml C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-400.HCBlack.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-right.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-256.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\SetupTeardown.ps1 C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetCompare_col.hxc C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendar.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square310x310\PaintLargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\ui-strings.js C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF64.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ExcelServices.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\156.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-80.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\msdaurl.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEES.DLL C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\MissingAlbumArt.jpg C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\MusicWhatsNewItems.json C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ga.txt C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\SmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileSmallSquare.scale-200.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\fa.pak.DATA C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\ja\DropSqlPersistenceProviderLogic.sql C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\HyperV-DynamicMemory-VirtualDevice-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.mum C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..ep-chxapp.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_7d8eee60f8081103\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-devices-haptics_31bf3856ad364e35_10.0.19041.264_none_22b5b9cd69282c16\r\Windows.Devices.Haptics.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1202_none_ca1e0a7a1f21274c\drvinst.exe C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..y-mdmcommon-onecore_31bf3856ad364e35_10.0.19041.746_none_b9ad1f8b13fd3844\f\MdmCommon.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Numerics.Vectors.resources.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.264.mum C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_c_sslaccel.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_83daa211cc9c2110\c_sslaccel.inf_loc C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\Containers-ApplicationGuard-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\Microsoft-Hyper-V-Offline-Core-Group-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..r-manager.resources_31bf3856ad364e35_10.0.19041.1_de-de_a4cb5add146741b2\cmservice.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\default-progress-vm.js C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-backup-cpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_83fb8580a25721c5\sdcpl.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-brokerinfrastructure_31bf3856ad364e35_10.0.19041.117_none_3c1920f753190d57\bisrv.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\CloudExperienceHostAPI.winmd C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\AppSetting.ascx.de.resx C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-NFS-ClientCore-D-Opt-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.mum C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Telnet-Client-Opt-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.mum C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..ws-minwin.resources_31bf3856ad364e35_10.0.19041.1_de-de_08f17580025a89a5\winload.exe.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\UnifiedEnrollment.DataModel.winmd C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Host-Guardian-Deployment-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-HyperV-OptionalFeature-VirtualMachinePlatform-Package~31bf3856ad364e35~amd64~~10.0.19041.264.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobeerror-main.html C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\WindowsFormsIntegration.resources.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\HyperV-Compute-Storage-merged-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\HyperV-Storage-QoS-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.mum C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-u..itefilter.resources_31bf3856ad364e35_10.0.19041.1266_en-us_b648a623c9262c3b\f\uwfrtl.sys.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Enterprise-Desktop-Shared-WOW64-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.mum C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-21h1-EKB-Wrapper-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.789.mum C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\Formatter\Html\HtmlFormatter.js C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-d..onmanager.resources_31bf3856ad364e35_10.0.19041.1_de-de_ad3145588be2eceb\DictationManager.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.tlb C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-Client-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_eventviewersettings.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_7bf34831f087e546\miguiresource.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-a..sibility-experience_31bf3856ad364e35_10.0.19041.746_none_69babc1ce4e23a84\cross.svg C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.1_none_0423901f2a62a812\fhuxpresentation.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.Runtime.Serialization.Formatters.Soap.resources.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\PolicyDefinitions\es-ES\wlansvc.adml C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-analog-h2-physicsplugin-baked_31bf3856ad364e35_10.0.19041.1_none_5fb69e670630e91d\physicsmaterialrubber.hbakedphysicsmaterial C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-dot3ui.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b2661abcc7353069\dot3dlg.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\Microsoft-Composable-PlatformExtension-DragDropCommon-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.mum C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Dedup-ChunkLibrary-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.mum C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-TerminalServices-Publishing-WMIProvider-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.mum C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\Fonts\vga775.fon C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\editUser.aspx.resx C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizard.aspx.es.resx C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-deliveryoptimization_31bf3856ad364e35_10.0.19041.207_none_a87fa27025b2eaac\r\dosvc.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\MultiPoint-Help-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\xboxTcuiContext.js C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..brokeredapi-desktop_31bf3856ad364e35_10.0.19041.964_none_a612f0b9f4217a31\f\Windows.Cortana.Desktop.dll C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..dservices.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fa358305ab788fdb\dsadmin.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-a..sibility-experience_31bf3856ad364e35_10.0.19041.1_none_41b27ed425707c3a\pin.svg C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\PolicyDefinitions\WinLogon.admx C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-RemoteFX-HyperV-Integration-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_dual_hidbatt.inf_31bf3856ad364e35_10.0.19041.1_none_053be026f01761fd\hidbatt.sys C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_dual_prnms012.inf_31bf3856ad364e35_10.0.19041.1_none_a3feabb281faa7e4\prnms012.inf C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Media-Streaming-WOW64-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.mum C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..acysnapin.resources_31bf3856ad364e35_10.0.19041.1_it-it_fa1b38e5fc197cc5\Cnfgprts.ocx.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-i..nents-rdv.resources_31bf3856ad364e35_10.0.19041.1_es-es_b39d4bf108b45afa\vmicrdv.dll.mui C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,41484365,39965824,7153487,17110988,17962391,17962392,3702920,3462423,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe

"C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe"

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
FR 40.79.150.121:443 tcp
NL 173.223.113.131:80 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 52.242.101.226:443 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
NL 173.223.113.164:443 tcp
US 204.79.197.203:80 tcp
US 52.242.101.226:443 tcp
US 209.197.3.8:80 tcp
US 52.242.101.226:443 tcp
US 52.242.101.226:443 tcp
US 52.242.101.226:443 tcp
US 52.242.101.226:443 tcp

Files

C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll

MD5 2fc4d42f568c9fee6e069f7ea46d5cc0
SHA1 318429f05909b5d4097c2840d64029bc76d08d0f
SHA256 f0d4d5993e3e236c288ab8534583da7a624b340c0f6160f61ff4e2df4a82d390
SHA512 8e419505b40f55486aaa25ddca9e19c575986ffcd606168dca0ffda25e3affc5e5104185647f5cc277c5f647a6358f0fd35f53ca20bcc208728659eaf43daee9

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll

MD5 77055f17bb0ddb795ef3a63ca0039bac
SHA1 433d647221c9bb54c3c76be44eed0c6a67b0a0de
SHA256 20f7fa3c8ab200d87ffa9f58c2700ab393893291338090ec900b6111ca561040
SHA512 5aab26f303672c3d745c303ea54ed5891529a0cc5860a4fb8fbb33abc2559ac064c44ea1a943301bd399f2616dd1e15d358474b1089d1cb11eb046d88d9d8d04

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll

MD5 c9dab12378f3f914ed34c23494ce74c0
SHA1 69c14443b2ebb2f1e726243288aab1d12b97db37
SHA256 18c514f88f60310f3cf25cda77924a01e0a36d14a0e9762756648c2c648ce705
SHA512 150fc79994d2af3fa38d61d875220c1baa3c24364423ee670718bd149be1129c52b30296bba44394eac8cbc587c065f04aa527522ef5c605f7221439fb7c7ca9

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll

MD5 25297efc3bf8d2cb34972e49f033fa0a
SHA1 291881891e917c780fc00b22021e5c391b060dfe
SHA256 1ed32eb18896bd5fb1f6281eb875ce21dfa9ea20ffaa7e6c3b94eeb23f13aedd
SHA512 2ebb012a8973913c4b849988884372550bc1e7c5dd3af01ac01feab49dca40227e653876fce6b13a2c364c04931d5c6bfe88ef23e7065d22279779605954d2dd

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll

MD5 d89cb906c358b2649e15b444a5e0411a
SHA1 93869f7039ae43e04344516234ab9e6a7811307b
SHA256 3ce0887e31ede3772dd5ff44a11fd8bf1611442e88b28605ffe881affc533aa0
SHA512 e4bcbd596b8ae810af9bddfb4b2128af2718e12e886ef9218a6c81638e60dcd69f162997c9771f830fe5248ade961d50a2abbfa2633bd28d90310d30710e23f6

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll

MD5 cd68777721d728fe1f0417afd2a7b8fa
SHA1 2b245556966182e297eca0a53e1af9f732182272
SHA256 62023fd2449f16654306b645c1617aeb84c913778ce128fa1c90840dd230361e
SHA512 93a500ee36496211d108d950d5b2877010d1544528fac16abc64a5798f535093a7a78f209b848527e6f559a6b4bd29317a4aa4afbac0be609afb946789a35e66

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll

MD5 64fa89fe1bdc88ef8db4cc8c7c8319ec
SHA1 e1aff65c5b65a6a06303d5fe3bb9b8b6cdf5921b
SHA256 863b48351587489dc53337324d2d0602f6df57cc51b39d5713cf4bbec9046621
SHA512 11af835730f761ba86f518bd8d18425287fbb25f49faaa2d82defc84f7794d5684327e84f36b91ef57262828b0989d4a126e75fce30911eecc552c266223658c

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll

MD5 ccc94602a6a71b59771ef2c321fe7bcd
SHA1 72fa3ce5942e46a3ddff792a6a9c95bcd9575646
SHA256 ef9d1539107155cf0fabe420790cb58d36fe562a5e2255ce472266669fc4bf98
SHA512 a731734703e12260a6fa37b4c0ec37d8afd0d97538c3383b59a9c15b6e44e6876babc3dba34e2bfc691b7f349632b6daeaaa97f388af7d5e57aa1fe17b781e31

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll

MD5 f5d4c22ced66b4f563c6640068aec6b4
SHA1 33ce26f849b4f981448567c379e6c88031c919e4
SHA256 df7abcdf3da7c974c481c90535cb143d5ba005c2972639c1b0613634dc6f055f
SHA512 97ed0d91c18a4a056f7914dd7899710c9447adde3bbbcc395197dfa297b265e835687ef9d030e850b2b031759448cf9369642bdc67f08c306c0c4aa1d7d9682f

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll

MD5 c7f5af65598cf219f1f7544f895edd4c
SHA1 82f2decf1eb8a3c3dd015194f02e07abe651959f
SHA256 d872c5c1b312f4b257cad8c1f77c7e3b1ed090611e7186438f0b0ca6db6638d0
SHA512 8fb9378b798ec099079a23ccb7c2ec29ca0d87e6864ecf020fa5e300bc0bd9425f13a466c677818ee38fe560ceb493aff33fa831c6af03fac1566deb07535829

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll

MD5 761277d21e3a31948012fef82b42f022
SHA1 08f7b27e33dd2d3cdfd54c283cdd22994a53402b
SHA256 6e1fec70fc0013137957242159edf04eafdb3c14d8a6f1ee2204d451114a19be
SHA512 0401fa3425ac8b472f9f42166e70906cc531c94782f2b0338281f983a5ad6f6fd6817b26fe59e841be25aacbfca0df88f672db5a4e17fa9e99d281d912db2d8f

C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll

MD5 2fc4d42f568c9fee6e069f7ea46d5cc0
SHA1 318429f05909b5d4097c2840d64029bc76d08d0f
SHA256 f0d4d5993e3e236c288ab8534583da7a624b340c0f6160f61ff4e2df4a82d390
SHA512 8e419505b40f55486aaa25ddca9e19c575986ffcd606168dca0ffda25e3affc5e5104185647f5cc277c5f647a6358f0fd35f53ca20bcc208728659eaf43daee9

memory/2752-145-0x0000000000C30000-0x0000000000DEE000-memory.dmp

memory/2752-146-0x0000000000C30000-0x0000000000DEE000-memory.dmp

memory/2752-147-0x0000000000C30000-0x0000000000DEE000-memory.dmp

memory/2752-149-0x0000000000C30000-0x0000000000DEE000-memory.dmp

memory/2752-151-0x0000000000C30000-0x0000000000DEE000-memory.dmp

memory/2752-152-0x0000000000C30000-0x0000000000DEE000-memory.dmp

memory/2752-153-0x0000000000C30000-0x0000000000DEE000-memory.dmp

memory/2752-154-0x0000000000C30000-0x0000000000DEE000-memory.dmp

memory/2752-155-0x0000000000C30000-0x0000000000DEE000-memory.dmp

memory/2752-156-0x0000000000C30000-0x0000000000DEE000-memory.dmp

memory/2752-157-0x0000000000C30000-0x0000000000DEE000-memory.dmp