Description	Indicator	Process	Target
File opened for modification	C:\Windows\System32\drivers\etc\hosts	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\System32\drivers\etc\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\networks	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\hosts.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\protocol	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\protocol.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\networks.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\services	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\services.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\services.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\hosts.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\networks.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\protocol.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Deletes itself

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\cmd.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSFEEditor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cc3652c078fa2bdfbbfae33335c30bda.exe\" e"	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Drops desktop.ini file(s)

Description	Indicator	Process	Target
File opened for modification	\??\E:\$RECYCLE.BIN\S-1-5-21-1650401615-1019878084-3673944445-1000\desktop.ini	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Enumerates connected drives

Description	Indicator	Process	Target
File opened (read-only)	\??\O:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\S:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\T:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\A:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\B:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\R:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\g:	C:\Windows\system32\vssadmin.exe	N/A
File opened (read-only)	\??\g:	C:\Windows\system32\vssadmin.exe	N/A
File opened (read-only)	\??\G:	C:\Windows\system32\vssadmin.exe	N/A
File opened (read-only)	\??\H:	C:\Windows\system32\vssadmin.exe	N/A
File opened (read-only)	\??\X:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\D:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\F:	C:\Windows\system32\vssadmin.exe	N/A
File opened (read-only)	\??\F:	C:\Windows\system32\vssadmin.exe	N/A
File opened (read-only)	\??\G:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\I:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\P:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\Y:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\D:	C:\Windows\system32\vssadmin.exe	N/A
File opened (read-only)	\??\D:	C:\Windows\system32\vssadmin.exe	N/A
File opened (read-only)	\??\K:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\V:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\G:	C:\Windows\system32\vssadmin.exe	N/A
File opened (read-only)	\??\h:	C:\Windows\system32\vssadmin.exe	N/A
File opened (read-only)	\??\h:	C:\Windows\system32\vssadmin.exe	N/A
File opened (read-only)	\??\N:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\Q:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\F:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\E:	C:\Windows\system32\vssadmin.exe	N/A
File opened (read-only)	\??\L:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\W:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\H:	C:\Windows\system32\vssadmin.exe	N/A
File opened (read-only)	\??\J:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\H:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\M:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\U:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\Z:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\E:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\E:	C:\Windows\system32\vssadmin.exe	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\COMPONENTS.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\System32\config\RegBack\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\e397d009-6db3-4408-8cc5-36fa792ae929	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\SAM	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\LogFiles\Scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\RegBack\SECURITY	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\b889ab5d-f7d2-47ff-92a1-3ec877b7e01c.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\e397d009-6db3-4408-8cc5-36fa792ae929.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\e760d343-7816-4f8e-b7b4-a3426f1a5535.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\c739a7bf-f3ef-4fc1-abb5-db07f5aee42b.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1e582198-061f-43f1-abdf-d4e9b606b035.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\SYSTEM	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1e582198-061f-43f1-abdf-d4e9b606b035.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\e760d343-7816-4f8e-b7b4-a3426f1a5535	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f22e410f-f947-4e08-8f2a-8f65df603f8d	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\BCD-Template.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\b889ab5d-f7d2-47ff-92a1-3ec877b7e01c.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\System32\Microsoft\Protect\S-1-5-18\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\BCD-Template	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\COMPONENTS.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\b889ab5d-f7d2-47ff-92a1-3ec877b7e01c	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\e760d343-7816-4f8e-b7b4-a3426f1a5535.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\LogFiles\Scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\RegBack\DEFAULT	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\RegBack\SYSTEM	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\c739a7bf-f3ef-4fc1-abb5-db07f5aee42b.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\System32\config\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1e582198-061f-43f1-abdf-d4e9b606b035	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\SECURITY	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\RegBack\SAM	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\RegBack\SOFTWARE	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\System32\LogFiles\Scm\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Palau	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Port_of_Spain	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\YST9.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Los_Angeles.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Zurich.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Efate	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Niue.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Nome	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Kuching	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Makassar.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Montevideo.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Brussels	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\La_Rioja	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7MDT.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Yellowknife	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh87.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vincennes	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\tzmappings	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\Syowa.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Irkutsk.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Araguaina.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\St_Johns.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Rome	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Midway.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Maputo.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Rainy_River	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Indian\Christmas.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Caracas.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Lima	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Bahia.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Ceuta.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Bogota	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Denver.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Detroit.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\COPYRIGHT.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\CET.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Swift_Current.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\Panther\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	C:\Windows\system32\wbadmin.exe	N/A
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	C:\Windows\system32\wbadmin.exe	N/A
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	C:\Windows\system32\wbadmin.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\2th2	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\1th2	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\absthr_0	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\Boot\PCAT\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\alloc_0	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Boot\DVD\EFI\BCD	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\alloc_2	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\2cb1	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\2cb2	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\2th0	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	C:\Windows\system32\wbadmin.exe	N/A
File created	C:\Windows\Boot\DVD\EFI\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\1th1	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\absthr_2	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\dewindow	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Panther\setupinfo.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Boot\PCAT\bootmgr	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\1cb2	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\absthr_1	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\2cb0	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\2th1	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\alloc_1	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	C:\Windows\system32\wbadmin.exe	N/A
File opened for modification	C:\Windows\Panther\setupinfo.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Boot\DVD\PCAT\BCD	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\ehome\CreateDisc\Components\tables\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\1cb1	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Panther\setupinfo	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\1cb0	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\1th0	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\alloc_3	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\enwindow	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	C:\Windows\system32\wbadmin.exe	N/A
File created	C:\Windows\Boot\DVD\PCAT\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeBackupPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2884 wrote to memory of 2900	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2900	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2900	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 1700	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 1700	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 1700	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2444	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2444	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2444	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2976	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2976	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2976	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2000	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2000	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2000	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 1648	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 1648	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 1648	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2868	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2868	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2868	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 1332	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 1332	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 1332	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2740	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2740	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2740	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 892	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 892	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 892	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2744	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2744	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2744	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 472	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 472	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 472	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\vssadmin.exe
PID 2884 wrote to memory of 2276	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\bcdedit.exe
PID 2884 wrote to memory of 2276	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\bcdedit.exe
PID 2884 wrote to memory of 2276	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\bcdedit.exe
PID 2884 wrote to memory of 1560	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\bcdedit.exe
PID 2884 wrote to memory of 1560	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\bcdedit.exe
PID 2884 wrote to memory of 1560	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\bcdedit.exe
PID 2884 wrote to memory of 1708	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\wbadmin.exe
PID 2884 wrote to memory of 1708	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\wbadmin.exe
PID 2884 wrote to memory of 1708	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\wbadmin.exe
PID 2884 wrote to memory of 2252	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\wbadmin.exe
PID 2884 wrote to memory of 2252	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\wbadmin.exe
PID 2884 wrote to memory of 2252	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\wbadmin.exe
PID 2884 wrote to memory of 1224	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\System32\Wbem\wmic.exe
PID 2884 wrote to memory of 1224	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\System32\Wbem\wmic.exe
PID 2884 wrote to memory of 1224	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\System32\Wbem\wmic.exe
PID 2884 wrote to memory of 2568	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\cmd.exe
PID 2884 wrote to memory of 2568	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\cmd.exe
PID 2884 wrote to memory of 2568	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\cmd.exe

System policy modification

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe

"C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe"

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled No

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CC3652~1.EXE >> NUL

Network

N/A

Files

C:\Recovery\52b0f462-d10e-11ee-9e98-caf795fd2ae4\!!!HOW_TO_DECRYPT!!!.mht

MD5	73d82f11c27bcc7d1f5a8241ac698120
SHA1	ed09ad9dd4fa21915716bfe2d676bdd2a4913235
SHA256	408f5d8ba062a1c911788e2f0bc2ea464f1e228cb30b92c7ebb1438304beac4f
SHA512	edd063e6225932fa3b372fb924cd38e53a45d83c42cd701f2352afe94293da534ca7c302f06aee5c7021c908ecf9f6cbf2d8f675a09a2362156e3d6bb4aea714

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-15 19:17

Reported

2024-03-15 19:20

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe"

Signatures

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SYSTEM32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\bcdedit.exe	N/A

Renames multiple (624) files with added filename extension

ransomware

Deletes System State backups

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SYSTEM32\wbadmin.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\wbadmin.exe	N/A

Drops file in Drivers directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\System32\drivers\etc\protocol.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\hosts	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\networks.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\protocol	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\services	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\hosts.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\networks.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\networks	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\protocol.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\services.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\services.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\drivers\etc\hosts.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\System32\drivers\etc\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSFEEditor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cc3652c078fa2bdfbbfae33335c30bda.exe\" e"	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Drops desktop.ini file(s)

Description	Indicator	Process	Target
File opened for modification	\??\E:\$RECYCLE.BIN\S-1-5-21-275798769-4264537674-1142822080-1000\desktop.ini	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Enumerates connected drives

Description	Indicator	Process	Target
File opened (read-only)	\??\B:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\J:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\K:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\R:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\H:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\N:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\O:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\P:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\F:	C:\Windows\SYSTEM32\vssadmin.exe	N/A
File opened (read-only)	\??\h:	C:\Windows\SYSTEM32\vssadmin.exe	N/A
File opened (read-only)	\??\H:	C:\Windows\SYSTEM32\vssadmin.exe	N/A
File opened (read-only)	\??\H:	C:\Windows\SYSTEM32\vssadmin.exe	N/A
File opened (read-only)	\??\D:	C:\Windows\SYSTEM32\vssadmin.exe	N/A
File opened (read-only)	\??\E:	C:\Windows\SYSTEM32\vssadmin.exe	N/A
File opened (read-only)	\??\A:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\I:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\T:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\Y:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\D:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\E:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\G:	C:\Windows\SYSTEM32\vssadmin.exe	N/A
File opened (read-only)	\??\h:	C:\Windows\SYSTEM32\vssadmin.exe	N/A
File opened (read-only)	\??\Z:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\S:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\D:	C:\Windows\SYSTEM32\vssadmin.exe	N/A
File opened (read-only)	\??\F:	C:\Windows\SYSTEM32\vssadmin.exe	N/A
File opened (read-only)	\??\g:	C:\Windows\SYSTEM32\vssadmin.exe	N/A
File opened (read-only)	\??\L:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\g:	C:\Windows\SYSTEM32\vssadmin.exe	N/A
File opened (read-only)	\??\M:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\Q:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\V:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\F:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\G:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\X:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\E:	C:\Windows\SYSTEM32\vssadmin.exe	N/A
File opened (read-only)	\??\G:	C:\Windows\SYSTEM32\vssadmin.exe	N/A
File opened (read-only)	\??\U:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened (read-only)	\??\W:	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\BBI	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\DRIVERS.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\SOFTWARE	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\COMPONENTS	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\SYSTEM	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\ResPriHMImageList	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\System32\Microsoft\Protect\S-1-5-18\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\BCD-Template.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\874b137a-79d5-4454-aeb9-76de170a07cb.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\System32\config\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\DRIVERS	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\ELAM.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\3fe2fbcd-ca12-431b-9836-7f8f73fe6c57	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\System32\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\UpdateModelTask	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\36dec4cf-0e45-4531-a00a-fd46059bae3e	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\ResPriHMImageListLowCost	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\ResPriImageList	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Report policies	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\SECURITY	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Report policies.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\874b137a-79d5-4454-aeb9-76de170a07cb.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\36dec4cf-0e45-4531-a00a-fd46059bae3e.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\UpdateModelTask.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Mozilla Firefox\postSigningData.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Google\Chrome\Application\master_preferences.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Program Files\Google\Chrome\Application\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Program Files\Mozilla Firefox\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Mozilla Firefox\postSigningData	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Google\Chrome\Application\master_preferences.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Google\Chrome\Application\master_preferences	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Mozilla Firefox\postSigningData.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\Installer\SourceHash{E016F2B9-01FE-4FAA-882E-ECC43FA49751}.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\SoftwareDistribution\Download\SharedFileCache\e1ea7b2e20a22fbee6e9dd5d883e9f3cc75fdee790ea383a755da4381088ec52.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_8a5f3b39-6e68-4fc5-bbb1-a0dd77d899e9	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{CB0836EC-B072-368D-82B2-D3470BF95707}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	C:\Windows\SYSTEM32\wbadmin.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{113C0ADC-B9BD-4F95-9653-4F5BC540ED03}.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{77924AE4-039E-4CA4-87B4-2F64180381F0}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{B175520C-86A2-35A7-8619-86DC379688B9}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{3A706840-2882-423C-90EB-B31545E2BC7A}.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{64A3A4F4-B792-11D6-A78A-00B0D0180381}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{662A0088-6FCD-45DD-9EA7-68674058AED5}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{7DAD0258-515C-3DD4-8964-BD714199E0F7}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\SoftwareDistribution\Download\SharedFileCache\ffb218cb78a2ca5b027e463f2a6bbb9c7036730212098e4fb7c330c70dcdfda4.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\Panther\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Boot\PCAT\bootmgr	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Boot\PCAT\bootnxt	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	C:\Windows\SYSTEM32\wbadmin.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{37B8F9C7-03FB-3253-8781-2517C99D7C00}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{CB0836EC-B072-368D-82B2-D3470BF95707}.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{90160000-007E-0000-1000-0000000FF1CE}.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{BF08E976-B92E-4336-B56F-2171179476C4}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Boot\DVD\PCAT\BCD	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_8a5f3b39-6e68-4fc5-bbb1-a0dd77d899e9.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{3A706840-2882-423C-90EB-B31545E2BC7A}.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{76DEEAB3-122F-4231-83C7-0C35363D02F9}.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{7DAD0258-515C-3DD4-8964-BD714199E0F7}.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{9BE518E6-ECC6-35A9-88E4-87755C07200F}.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\AppReadiness\S-1-5-21-275798769-4264537674-1142822080-1000	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{90160000-008C-0000-1000-0000000FF1CE}.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{AE86D888-1404-47CC-A7BB-8D86C0503E58}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{113C0ADC-B9BD-4F95-9653-4F5BC540ED03}.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{90160000-008C-0409-1000-0000000FF1CE}.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\SoftwareDistribution\Download\SharedFileCache\e1ea7b2e20a22fbee6e9dd5d883e9f3cc75fdee790ea383a755da4381088ec52	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	C:\Windows\SYSTEM32\wbadmin.exe	N/A
File created	C:\Windows\AppReadiness\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{76DEEAB3-122F-4231-83C7-0C35363D02F9}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates\My\!!!HOW_TO_DECRYPT!!!.mht	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{BF08E976-B92E-4336-B56F-2171179476C4}.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{113C0ADC-B9BD-4F95-9653-4F5BC540ED03}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{7DAD0258-515C-3DD4-8964-BD714199E0F7}.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{90160000-007E-0000-1000-0000000FF1CE}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{4A03706F-666A-4037-7777-5F2748764D10}.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{AC76BA86-7AD7-1033-7B44-AC0F074E4100}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Panther\setupinfo.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{1D8E6291-B0D5-35EC-8441-6616F567A0F7}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}.gpay	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\SoftwareDistribution\Download\SharedFileCache\e1ea7b2e20a22fbee6e9dd5d883e9f3cc75fdee790ea383a755da4381088ec52.inprocess	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{90160000-008C-0000-1000-0000000FF1CE}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
File opened for modification	C:\Windows\Installer\SourceHash{D44822A8-FC28-42FC-8B1D-21A78579FC79}	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SYSTEM32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\vssadmin.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeBackupPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A
Token: 36	N/A	C:\Windows\System32\Wbem\wmic.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2392 wrote to memory of 2316	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 2316	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 688	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 688	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 1812	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 1812	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 2284	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 2284	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 952	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 952	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 1096	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 1096	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 3692	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 3692	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 2616	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 2616	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 4636	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 4636	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 220	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 220	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 4380	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 4380	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 812	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 812	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 2972	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 2972	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\vssadmin.exe
PID 2392 wrote to memory of 3508	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\bcdedit.exe
PID 2392 wrote to memory of 3508	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\bcdedit.exe
PID 2392 wrote to memory of 3048	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\bcdedit.exe
PID 2392 wrote to memory of 3048	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\bcdedit.exe
PID 2392 wrote to memory of 3216	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\wbadmin.exe
PID 2392 wrote to memory of 3216	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\wbadmin.exe
PID 2392 wrote to memory of 1448	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\wbadmin.exe
PID 2392 wrote to memory of 1448	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\SYSTEM32\wbadmin.exe
PID 2392 wrote to memory of 1732	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\System32\Wbem\wmic.exe
PID 2392 wrote to memory of 1732	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\System32\Wbem\wmic.exe
PID 2392 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\cmd.exe
PID 2392 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	C:\Windows\system32\cmd.exe

System policy modification

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	C:\Users\Admin\AppData\Local\Temp\cc3652c078fa2bdfbbfae33335c30bda.exe	N/A

Uses Volume Shadow Copy service COM API

ransomware