Manipulation of default file association configuration

When a file is opened, the default program used to open the file, its handler, is checked. File association selections are stored in the Windows Registry and can be edited by users. Malware can modify or create a file association for a given file extension to call another program when a given extension is opened.

Module:

Platform Analytics

Agent event type:

Registry

Category:

Persistence

Status:

Enabled