Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A

Renames multiple (314) files with added filename extension

ransomware

Deletes backup catalog

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\wbadmin.exe	N/A
N/A	N/A	C:\Windows\system32\wbadmin.exe	N/A

Modifies Windows Firewall

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\netsh.exe	N/A
N/A	N/A	C:\Windows\system32\netsh.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f = "C:\\Users\\Admin\\AppData\\Local\\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe"	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f = "C:\\Users\\Admin\\AppData\\Local\\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe"	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A

Drops desktop.ini file(s)

Description	Indicator	Process	Target
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\CJQLK5UF\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Videos\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Music\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Documents\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1658372521-4246568289-2509113762-1000\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Downloads\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Videos\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Music\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\5B8DS9TT\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3DCZZ4GN\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Searches\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Pictures\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z9MW37VJ\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y3HLRHFA\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MRWZP5ZY\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Libraries\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JQHF6B80\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Documents\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2000 set thread context of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2664 set thread context of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALNDR98.POC.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21342_.GIF.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Premium.gif	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01635_.WMF.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200151.WMF.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableUpArrow.jpg	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\library.js	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Paper.eftx.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.bat	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\America\Lima.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\Office14\SplashScreen.bmp.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03339_.WMF	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\es-ES\sbdrop.dll.mui	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_sk.dll.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02071_.WMF	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\MSGR3ES.DLL.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-ui.jar.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\EDGE.INF.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\bin\dtplugin\deployJava1.dll	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\TAB_OFF.GIF	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Resource.zip	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\PAPYRUS.INF	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099191.JPG	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WHIRL2.WMF.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.jdp_5.5.0.165303.jar	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Godthab	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152884.WMF	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\Office14\misc.exe.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SHAREPOINTPROVIDER.DLL	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Internet Explorer\JSProfilerCore.dll	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\bin\instrument.dll	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Aspect.xml.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00006_.WMF	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Cordoba.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB4.BDR.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\search_background.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\LICENSE	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.id[3C62C0CA-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent_partly-cloudy.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	C:\Windows\SysWOW64\mshta.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	C:\Windows\SysWOW64\mshta.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	C:\Windows\SysWOW64\mshta.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	C:\Windows\SysWOW64\mshta.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\wbengine.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\wbengine.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\system32\wbengine.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2000 wrote to memory of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2000 wrote to memory of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2000 wrote to memory of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2000 wrote to memory of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2000 wrote to memory of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2000 wrote to memory of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2000 wrote to memory of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2000 wrote to memory of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2000 wrote to memory of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2000 wrote to memory of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2000 wrote to memory of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2664 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2664 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2664 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2664 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2664 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2664 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2664 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2664 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2664 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2664 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2664 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2664 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2664 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2664 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2664 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2832 wrote to memory of 2412	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\system32\cmd.exe
PID 2832 wrote to memory of 2412	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\system32\cmd.exe
PID 2832 wrote to memory of 2412	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\system32\cmd.exe
PID 2832 wrote to memory of 2412	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\system32\cmd.exe
PID 2832 wrote to memory of 2468	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\system32\cmd.exe
PID 2832 wrote to memory of 2468	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\system32\cmd.exe
PID 2832 wrote to memory of 2468	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\system32\cmd.exe
PID 2832 wrote to memory of 2468	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\system32\cmd.exe
PID 2468 wrote to memory of 2396	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\vssadmin.exe
PID 2468 wrote to memory of 2396	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\vssadmin.exe
PID 2468 wrote to memory of 2396	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\vssadmin.exe
PID 2412 wrote to memory of 2592	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\netsh.exe
PID 2412 wrote to memory of 2592	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\netsh.exe
PID 2412 wrote to memory of 2592	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\netsh.exe
PID 2412 wrote to memory of 2812	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\netsh.exe
PID 2412 wrote to memory of 2812	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\netsh.exe
PID 2412 wrote to memory of 2812	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\netsh.exe
PID 2468 wrote to memory of 1632	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2468 wrote to memory of 1632	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2468 wrote to memory of 1632	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2468 wrote to memory of 2884	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2468 wrote to memory of 2884	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2468 wrote to memory of 2884	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2468 wrote to memory of 2036	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2468 wrote to memory of 2036	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2468 wrote to memory of 2036	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2468 wrote to memory of 620	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\wbadmin.exe
PID 2468 wrote to memory of 620	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\wbadmin.exe
PID 2468 wrote to memory of 620	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\wbadmin.exe
PID 2832 wrote to memory of 1632	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2832 wrote to memory of 1632	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2832 wrote to memory of 1632	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2832 wrote to memory of 1632	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2832 wrote to memory of 1260	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2832 wrote to memory of 1260	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2832 wrote to memory of 1260	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2832 wrote to memory of 1260	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2832 wrote to memory of 1980	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe

"C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe"

C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe

C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe

C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe

"C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe"

C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe

C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe

C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe

C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

N/A

Files

memory/2000-0-0x0000000001340000-0x00000000013E4000-memory.dmp

memory/2000-1-0x00000000748E0000-0x0000000074FCE000-memory.dmp

memory/2000-2-0x00000000004B0000-0x00000000004F6000-memory.dmp

memory/2000-3-0x0000000001170000-0x00000000011B0000-memory.dmp

memory/2000-4-0x00000000012C0000-0x00000000012F4000-memory.dmp

memory/2000-5-0x0000000004AD0000-0x0000000004B1C000-memory.dmp

memory/2832-6-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2832-8-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2832-12-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2832-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2832-20-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2000-22-0x00000000748E0000-0x0000000074FCE000-memory.dmp

memory/2832-16-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2832-14-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2832-10-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2832-23-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2832-24-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2664-25-0x0000000001340000-0x00000000013E4000-memory.dmp

memory/2664-26-0x0000000074820000-0x0000000074F0E000-memory.dmp

memory/2664-27-0x0000000004C10000-0x0000000004C50000-memory.dmp

memory/2548-40-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2664-44-0x0000000074820000-0x0000000074F0E000-memory.dmp

memory/2548-46-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2832-56-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2832-59-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2832-61-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2832-58-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2832-60-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2832-62-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2832-73-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2832-74-0x0000000000400000-0x0000000000413000-memory.dmp

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[3C62C0CA-3483].[[email protected]].8base

MD5	87cec5d92c45bbc810ff44d8890e3faa
SHA1	ff239ad6012e1ae9a7d9a6c3a5e528a1b3201651
SHA256	3e32605b1ae976ffc13c8ca9d5fcc772dc023ff407e4ee5d7b47119b2bcafd5e
SHA512	86cf2ad78b58b5bd351facff85f1dbf18e0766cc6e0159a76599eb8fbd24ceb110383ba0546a7b3b7f5f2834a479109b55b79181becd731e2ff4f8223018298d

memory/2832-82-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2832-90-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2832-2266-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2548-3655-0x0000000000400000-0x0000000000413000-memory.dmp

C:\info.hta

MD5	70a84e31ba6b58e0d44a11755e0847a0
SHA1	a1621a69d207a934f03cd59704e54588675fc940
SHA256	4568687badfd7104c8771e5cc9beaa01d40c5d234eb85f443e2a4b9ba54cb5f1
SHA512	56cdb57fb31de9c77fb24889f3faf43b4b27530fe9698f015058e46e85b0ce820248fc0df3cb9b4e7995cc0ceec9b777235620f3e5a5e8330b02faa3b89b1231

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-21 10:36

Reported

2024-03-21 10:40

Platform

win10v2004-20240226-en

Max time kernel

209s

Max time network

210s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe"

Signatures

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A

Renames multiple (503) files with added filename extension

ransomware

Deletes backup catalog

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\wbadmin.exe	N/A
N/A	N/A	C:\Windows\system32\wbadmin.exe	N/A

Modifies Windows Firewall

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\netsh.exe	N/A
N/A	N/A	C:\Windows\system32\netsh.exe	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f = "C:\\Users\\Admin\\AppData\\Local\\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe"	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f = "C:\\Users\\Admin\\AppData\\Local\\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe"	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A

Drops desktop.ini file(s)

Description	Indicator	Process	Target
File opened for modification	C:\Users\Admin\Links\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Videos\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Music\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Music\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Searches\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Downloads\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Documents\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\$Recycle.Bin\S-1-5-21-399997616-3400990511-967324271-1000\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Videos\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Documents\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Libraries\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Desktop\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-399997616-3400990511-967324271-1000\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Users\Public\Pictures\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\desktop.ini	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 4196 set thread context of 2184	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2988 set thread context of 5124	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe

Drops file in Program Files directory

Description	Indicator	Process	Target
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_fil.dll.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.MagicEdit\Pages\ThreeWayBlendPage.xbf	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\ui-strings.js	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_sse2_plugin.dll.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Eye.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxManifest.xml	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\iadata\BlockPair.bin	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\BuildInfo.xml	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraMedTile.scale-125.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_reportabuse-default_18.svg.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\bg_patterns_header.png.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\selector.js	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nl-nl\ui-strings.js	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluNoInternetConnection_120x80.svg	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_download_pdf_18.svg.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ExcelServices.dll	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\msedgeupdateres_eu.dll	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-32_altform-unplated.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.psm1	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-16.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeWideTile.scale-200.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\CoreEngine\Data\BrushProfile\BrushBump64.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-96.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\msedgeupdateres_gu.dll.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\PresentationUI.resources.dll.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookLargeTile.scale-200.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hu-hu\ui-strings.js.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\ui-strings.js	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jfxswt.jar	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-200.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\progress.gif	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-200_contrast-white.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieTextModel.bin.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBCTRAC.DLL	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-100_contrast-black.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\ui-strings.js.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SpreadsheetIQ.Diagram.dll	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\ui-strings.js	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\System\concrt140.dll	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-399997616-3400990511-967324271-1000-MergedResources-0.pri	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\Microsoft.VisualBasic.Forms.resources.dll	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\LargeTile.scale-125_contrast-black.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\159.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_contrast-white.png	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL.id[4B1FC73D-3483].[[email protected]].8base	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	C:\Windows\System32\vds.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	C:\Windows\System32\vds.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	C:\Windows\System32\vds.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	C:\Windows\System32\vds.exe	N/A

Interacts with shadow copies

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\wbengine.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\wbengine.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\system32\wbengine.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4196 wrote to memory of 2184	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 4196 wrote to memory of 2184	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 4196 wrote to memory of 2184	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 4196 wrote to memory of 2184	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 4196 wrote to memory of 2184	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 4196 wrote to memory of 2184	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 4196 wrote to memory of 2184	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 4196 wrote to memory of 2184	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 4196 wrote to memory of 2184	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 4196 wrote to memory of 2184	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2988 wrote to memory of 5012	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2988 wrote to memory of 5012	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2988 wrote to memory of 5012	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2988 wrote to memory of 5124	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2988 wrote to memory of 5124	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2988 wrote to memory of 5124	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2988 wrote to memory of 5124	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2988 wrote to memory of 5124	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2988 wrote to memory of 5124	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2988 wrote to memory of 5124	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2988 wrote to memory of 5124	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2988 wrote to memory of 5124	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2988 wrote to memory of 5124	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
PID 2184 wrote to memory of 5460	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\system32\cmd.exe
PID 2184 wrote to memory of 5460	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\system32\cmd.exe
PID 2184 wrote to memory of 3068	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\system32\cmd.exe
PID 2184 wrote to memory of 3068	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 3952	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\netsh.exe
PID 5460 wrote to memory of 2016	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\vssadmin.exe
PID 3068 wrote to memory of 3952	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\netsh.exe
PID 5460 wrote to memory of 2016	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\vssadmin.exe
PID 3068 wrote to memory of 3284	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\netsh.exe
PID 3068 wrote to memory of 3284	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\netsh.exe
PID 5460 wrote to memory of 4528	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 5460 wrote to memory of 4528	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 5460 wrote to memory of 5264	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 5460 wrote to memory of 5264	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 5460 wrote to memory of 5476	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 5460 wrote to memory of 5476	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 5460 wrote to memory of 5904	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\wbadmin.exe
PID 5460 wrote to memory of 5904	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\wbadmin.exe
PID 2184 wrote to memory of 3068	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2184 wrote to memory of 3068	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2184 wrote to memory of 3068	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2184 wrote to memory of 3768	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2184 wrote to memory of 3768	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2184 wrote to memory of 3768	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2184 wrote to memory of 6056	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2184 wrote to memory of 6056	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2184 wrote to memory of 6056	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2184 wrote to memory of 5072	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2184 wrote to memory of 5072	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2184 wrote to memory of 5072	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\SysWOW64\mshta.exe
PID 2184 wrote to memory of 2096	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\system32\cmd.exe
PID 2184 wrote to memory of 2096	N/A	C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe	C:\Windows\system32\cmd.exe
PID 2096 wrote to memory of 3532	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\vssadmin.exe
PID 2096 wrote to memory of 3532	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\vssadmin.exe
PID 2096 wrote to memory of 5640	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2096 wrote to memory of 5640	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\Wbem\WMIC.exe
PID 2096 wrote to memory of 3656	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2096 wrote to memory of 3656	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2096 wrote to memory of 5636	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2096 wrote to memory of 5636	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\bcdedit.exe
PID 2096 wrote to memory of 2004	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\wbadmin.exe