resource	yara_rule
behavioral2/memory/4104-0-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4104-1-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4104-2-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4104-7-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4104-835-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4104-836-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4104-841-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4104-1207-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4104-4336-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4104-9429-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4104-10771-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4104-10772-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral2/memory/4104-10773-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona

description	ioc	process
File created	\??\c:\Program Files\Common Files\System\Ole DB\it-IT\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Windows Defender\Offline\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Windows Media Player\it-IT\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\es\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Content\holoLens\en-US\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\PAGESIZE\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\Updates\Download\PackageFiles\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\VideoLAN\VLC\plugins\stream_filter\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\VideoLAN\VLC\plugins\visualization\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\nl\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\uk-UA\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\VideoLAN\VLC\plugins\spu\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Windows Multimedia Platform\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\contrast-black\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Internet Explorer\es-ES\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\ga\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\uk\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\zh_CN\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Common Files\System\ado\de-DE\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Java\jdk-1.8\jre\lib\jfr\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\Lumia.ViewerPlugin\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\da\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2017.125.40.0_neutral_split.scale-200_8wekyb3d8bbwe\microsoft.system.package.metadata\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\cs-CZ\how_to_decrypt.hta	8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0.exe

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads