Overview
overview
10Static
static
BS.exe
windows7_x64
10BS.exe
windows10_x64
10BuildS.exe
windows7_x64
10BuildS.exe
windows10_x64
10READS.exe
windows7_x64
10READS.exe
windows10_x64
10baseus_nowin.exe
windows7_x64
10baseus_nowin.exe
windows10_x64
10rbs.exe
windows7_x64
10rbs.exe
windows10_x64
10scan.exe
windows7_x64
1scan.exe
windows10_x64
1Analysis
-
max time kernel
161s -
max time network
143s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
20-10-2021 09:41
Static task
static1
Behavioral task
behavioral1
Sample
BS.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
BS.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
BuildS.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
BuildS.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
READS.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
READS.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
baseus_nowin.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
baseus_nowin.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral9
Sample
rbs.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral10
Sample
rbs.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral11
Sample
scan.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral12
Sample
scan.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
BuildS.exe
-
Size
53KB
-
MD5
d0feecd8202129bb9c19823a04cd93ce
-
SHA1
631b2e3c26dfa53778d881e592cc9e499e7f98bb
-
SHA256
0dc4a2e2f49b2a6265a3c011d186a6f79ca8356d49d1c687465a5d994b6db38a
-
SHA512
03676f15ee822f550e2dc5e979d205ce0f154d2e1062a7d8257931ca945c6f536de913f28f4abc0a399a0b1bacd380cbff3f26d0ec597c0d7593f349b121e097
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">����������31 16 4A 77 0A 03 4D FB FE 1D AD 0C 42 C2 04 92
16 1A 31 D2 FF 45 A3 ED DD 59 1F C0 E1 94 BE 8D
7E B1 36 96 61 D4 5E F3 09 DB DB 22 4C 8E B3 55
B3 9B 41 9B 2A B5 BC 7C 43 0A 36 1F FA C8 20 7B
10 CA DB 54 3D E5 AB 4B 32 6A 4C 4B 71 92 78 BD
CC 95 01 E0 CE C3 6D 73 77 E2 55 8C 0C BC 57 A1
62 25 E6 B7 87 6A 4A F3 A9 06 8D C0 F8 E9 59 FE
FC 5E 63 22 95 58 A4 9E CE DB D2 46 1E 04 3C B3
1D 13 B7 2C F4 15 53 42 B8 82 3E B9 3E 25 8B D4
B0 71 2C FA 8F 29 DE AE 1E 67 78 10 3B 16 32 BD
27 8B 51 3B E7 53 7D F6 70 49 73 6D 9B BA 8F 95
70 94 36 C5 9F 45 D8 3D 03 79 6E 49 A4 BE 9F B6
AF 77 F6 29 D2 2B BC E6 85 BF 9A E0 99 17 71 19
3A B7 93 F6 3F 11 BB 50 D1 1C 42 0A C3 83 BC 88
02 0A 3F BF 0F E8 25 1F 3A 8D 15 2C 57 1F 12 F0
26 16 9D BB EF E2 E7 34 15 03 DD 18 7E E1 41 15
</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
</a><br>
4. Start a chat and follow the further instructions. <br><br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a>
<br><a href="[email protected]">[email protected]</a>
<br>
<b>* To contact us, create a new free email account on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
�����������
Emails
Signatures
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ApproveStart.tiff => C:\Users\Admin\Pictures\ApproveStart.tiff.LOCK BuildS.exe File renamed C:\Users\Admin\Pictures\ReceiveConvertFrom.png => C:\Users\Admin\Pictures\ReceiveConvertFrom.png.LOCK BuildS.exe File renamed C:\Users\Admin\Pictures\RemoveTest.raw => C:\Users\Admin\Pictures\RemoveTest.raw.LOCK BuildS.exe File renamed C:\Users\Admin\Pictures\UnlockUninstall.png => C:\Users\Admin\Pictures\UnlockUninstall.png.LOCK BuildS.exe File opened for modification C:\Users\Admin\Pictures\ApproveStart.tiff BuildS.exe File opened for modification C:\Users\Admin\Pictures\CompressRestore.tiff BuildS.exe File renamed C:\Users\Admin\Pictures\CompressRestore.tiff => C:\Users\Admin\Pictures\CompressRestore.tiff.LOCK BuildS.exe File renamed C:\Users\Admin\Pictures\DisableMove.raw => C:\Users\Admin\Pictures\DisableMove.raw.LOCK BuildS.exe File renamed C:\Users\Admin\Pictures\SearchOpen.crw => C:\Users\Admin\Pictures\SearchOpen.crw.LOCK BuildS.exe File renamed C:\Users\Admin\Pictures\ShowClose.raw => C:\Users\Admin\Pictures\ShowClose.raw.LOCK BuildS.exe File renamed C:\Users\Admin\Pictures\ShowTrace.png => C:\Users\Admin\Pictures\ShowTrace.png.LOCK BuildS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 26 IoCs
description ioc Process File opened for modification C:\Users\Public\Libraries\desktop.ini BuildS.exe File opened for modification C:\Users\Public\Documents\desktop.ini BuildS.exe File opened for modification C:\Users\Admin\Videos\desktop.ini BuildS.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini BuildS.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini BuildS.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini BuildS.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini BuildS.exe File opened for modification C:\Program Files (x86)\desktop.ini BuildS.exe File opened for modification C:\Users\Public\Pictures\desktop.ini BuildS.exe File opened for modification C:\Users\Public\Desktop\desktop.ini BuildS.exe File opened for modification C:\Users\Admin\Searches\desktop.ini BuildS.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini BuildS.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini BuildS.exe File opened for modification C:\Users\Admin\Music\desktop.ini BuildS.exe File opened for modification C:\Program Files\desktop.ini BuildS.exe File opened for modification C:\Users\Public\Music\desktop.ini BuildS.exe File opened for modification C:\Users\Public\Downloads\desktop.ini BuildS.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini BuildS.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini BuildS.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini BuildS.exe File opened for modification C:\Users\Public\desktop.ini BuildS.exe File opened for modification C:\Users\Public\Videos\desktop.ini BuildS.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini BuildS.exe File opened for modification C:\Users\Admin\Links\desktop.ini BuildS.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini BuildS.exe File opened for modification C:\Users\Admin\Documents\desktop.ini BuildS.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\NativeShim.dll BuildS.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\how_to_back_files.html BuildS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions2x.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-20.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\Effects\part.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\MainPage\silverIcon.png BuildS.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\eu-es\how_to_back_files.html BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\Pyramid\Goal_3.jpg BuildS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_hover_18.svg BuildS.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\msproof7imm.dll BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\AppxBlockMap.xml BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\SharpDXEngine\Rendering\Shaders\Builtin\HLSL\ConstantsPerObjectInstanced.fx BuildS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp_2x.gif BuildS.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.Oart.dll BuildS.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-100.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\3838_32x32x32.png BuildS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\msmdlocal.dll BuildS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sk-sk\ui-strings.js BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorWideTile.scale-200.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7656_24x24x32.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\SmallTile.scale-200.png BuildS.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\how_to_back_files.html BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\Square71x71\PaintSmallTile.scale-150.png BuildS.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\liboldmovie_plugin.dll BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\6.jpg BuildS.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\how_to_back_files.html BuildS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\ui-strings.js BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreWideTile.scale-200.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-40.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\MedTile.scale-100_contrast-black.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_contrast-black.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Microsoft.Xaml.Interactivity.winmd BuildS.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6416_40x40x32.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Aquarium\aquarium_12h.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\mask\13c.png BuildS.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libps_plugin.dll BuildS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\GenericMailSmallTile.scale-200.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\9.png BuildS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sortedby_up_18.svg BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-72_contrast-white.png BuildS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\ui-strings.js BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSectionLargeTile.scale-125.png BuildS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OSF.DLL BuildS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\ui-strings.js BuildS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\s_agreement_filetype.svg BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-100_contrast-black.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\Lumia.ViewerPlugin\Assets\IconOpenInRefocus.scale-100.png BuildS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\es-es\ui-strings.js BuildS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\ui-strings.js BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\sg_60x42.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderSplashScreen.contrast-black_scale-125.png BuildS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\sqlite.dll BuildS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\rain.png BuildS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Microsoft.Office.Interop.Access.dll BuildS.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\how_to_back_files.html BuildS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluDCFilesEmpty_180x180.svg BuildS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\ui-strings.js BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Buttons\Deal\New-Deal-up.png BuildS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\5px.png BuildS.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\how_to_back_files.html BuildS.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-200_contrast-white.png BuildS.exe