Malware Analysis Report

2024-09-22 12:37

Sample ID 240417-rt43faca49
Target 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02
SHA256 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02
Tags
upx troldesh discovery persistence ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02

Threat Level: Known bad

The file 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02 was found to be: Known bad.

Malicious Activity Summary

upx troldesh discovery persistence ransomware spyware stealer trojan

Troldesh, Shade, Encoder.858

Deletes shadow copies

Modifies Installed Components in the registry

Reads user/profile data of web browsers

UPX packed file

Checks installed software on the system

Adds Run key to start application

Enumerates connected drives

Sets desktop wallpaper using registry

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Modifies Internet Explorer settings

Interacts with shadow copies

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Uses Volume Shadow Copy WMI provider

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Uses Volume Shadow Copy service COM API

Suspicious use of FindShellTrayWindow

Modifies registry class

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Uses Task Scheduler COM API

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-04-17 14:30

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-17 14:30

Reported

2024-04-17 20:52

Platform

win10-20240319-en

Max time kernel

1792s

Max time network

1599s

Command Line

"C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe"

Signatures

Troldesh, Shade, Encoder.858

ransomware trojan troldesh

Deletes shadow copies

ransomware

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened (read-only) \??\D: C:\Windows\explorer.exe N/A
File opened (read-only) \??\F: C:\Windows\explorer.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\9D66F3A49D66F3A4.bmp" C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-48_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Beach\beach_11c.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\CardBacks\CardBack1.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\EmbossContour.scale-140.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\Assets\SmallLogo.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\LiveTiles\Traffic.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp3.scale-125.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-30.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\highfive.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-60_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-72_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\OutlookMailSmallTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-16_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-96_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-20_contrast-high.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\cc_60x42.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-16.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ls_16x11.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\sl_60x42.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\MedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-60.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailBadge.scale-150.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-36.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorMedTile.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\poolparty.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\Perfect\ribbon.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\MedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\de_60x42.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\smoking.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\smirk.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W7.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-20.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\BuildInfo.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-20_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.StarClub\Assets\Star-Club-button_gold.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-400.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\MainPage\mainPage_more_themes.jpg C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-white\WideLogo.scale-150_contrast-white.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-40.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\LargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Light.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5606_24x24x32.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-40.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PeopleMedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\8041_24x24x32.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_scale-125.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\4583_32x32x32.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\MedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-125.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-40_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.tree.dat C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\ C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File created C:\Windows\rescache\_merged\2717123927\1590785016.pri C:\Windows\explorer.exe N/A
File created C:\Windows\rescache\_merged\1601268389\715946058.pri C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
File created C:\Windows\rescache\_merged\4032412167\4002656488.pri C:\Windows\explorer.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities C:\Windows\explorer.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcc000000000000002000000e80704004100720067006a006200650078002000200033000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c0000000000000000000000005a76b4ae0691da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80704004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000e27a95ae0691da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e80703004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc760000000000000000000000005d34c43a127ada0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "129" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133553356506901188" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "0" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "0" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1144 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 1144 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 1144 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 1144 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 4496 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 4496 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 4496 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 4496 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 4496 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 4496 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

"C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe"

C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

C:\Windows\system32\vssadmin.exe

C:\Windows\system32\vssadmin.exe List Shadows

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssadmin.exe

C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssadmin.exe

C:\Windows\system32\vssadmin.exe List Shadows

C:\Windows\explorer.exe

explorer.exe

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe

"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca

Network

Country Destination Domain Proto
N/A 127.0.0.1:49803 tcp
SE 171.25.193.9:80 tcp
US 8.8.8.8:53 9.193.25.171.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 208.83.223.34:80 tcp
US 8.8.8.8:53 59.189.79.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
AT 86.59.21.38:443 tcp
US 8.8.8.8:53 71.121.18.2.in-addr.arpa udp
US 128.31.0.39:9101 tcp

Files

memory/1144-0-0x0000000000400000-0x000000000062A000-memory.dmp

memory/1144-1-0x0000000000400000-0x000000000062A000-memory.dmp

memory/1144-2-0x0000000000400000-0x000000000062A000-memory.dmp

memory/1144-5-0x0000000000400000-0x000000000062A000-memory.dmp

memory/1144-8-0x0000000002420000-0x0000000002454000-memory.dmp

memory/1144-9-0x0000000000400000-0x000000000062A000-memory.dmp

memory/4496-10-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-11-0x0000000000400000-0x0000000000608000-memory.dmp

memory/1144-14-0x0000000002420000-0x0000000002454000-memory.dmp

memory/4496-13-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-18-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-19-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-20-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-21-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-22-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-23-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-24-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-27-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-28-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-29-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-30-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-31-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-32-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-33-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-34-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-35-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-36-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-37-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-38-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-39-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-40-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-41-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-42-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-43-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-44-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-45-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-46-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-47-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-48-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-49-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-50-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-51-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-52-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-53-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-54-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-55-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-56-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-57-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-58-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-59-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-60-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-61-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-62-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-63-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-64-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-65-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-66-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-67-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-68-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-69-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-70-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-71-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-72-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-73-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-74-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-75-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-76-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-77-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-78-0x0000000000400000-0x0000000000608000-memory.dmp

memory/4496-79-0x0000000000400000-0x0000000000608000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db

MD5 ae6fbded57f9f7d048b95468ddee47ca
SHA1 c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA256 d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
SHA512 f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Q7R4L46I\microsoft.windows[1].xml

MD5 ec5f7f7d3ba6a617bcc377c82512e849
SHA1 5b8b713146e2b2e813b6bf3b141faa8ff97eaacf
SHA256 25bc6b4c838de26effb79b0b84ec497fe6be27ddfb085c6d16ce687b94a84c2c
SHA512 a5625890e82a965790bfd4e909d4c9a1acae2d21baac9c0bdb51e642c3331c74fbc80b792e78b12a9fa738785246fd97318e79a16b0136b841cea5f648f1c545

C:\Users\Admin\AppData\Roaming\9D66F3A49D66F3A4.bmp

MD5 993cc909a89f0fb7fe90acc3703c2105
SHA1 f422cdcb426718b235a19080b0daf71c9b448768
SHA256 4aa6cdb9ce95410f85a05b21967d224cfd49cf8c7fa18d9998304a16d4e4b5d8
SHA512 5ec562b1e6f91f8774bf8fd00a6a413b4b4b5be2ede17ff9c417fce7097b7d313b136740e525c19a77f220e80fb0e92f8f4d1866ea185c9fc6755c3b41aa9762

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

MD5 d90d90938ab6328d256eeabf24ff8429
SHA1 f67a912f32c7cb54b51841accd6b31c13f2e0520
SHA256 fc92671a3f41f3db17c84cfea9ffb78cd7d39bc5b7dc0b5109833d686f28ca9d
SHA512 54d2a82246a711560d569d499e5f71364e9ae6c49f82e5c4ad03dcf2aa3e0ef7bf77fc5dc4b582d65dc73d82480823293350481a37adc3c1c70fd653225ebe15

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

MD5 d236233d47fa01235b56a7c25133a1bc
SHA1 ac8abb682a58d9590f4eea0ada8cc2acf982b3f0
SHA256 0ee876910cc6665097f66f1f49f09b4de336967279a2f557099def6d971bcc1f
SHA512 bbe44642f7002b654fc245308076ec73b240944a49b2dc4374849e68c8259c783180138414df52fee1fcecc6b478452e70780eabaaab87324f428984a3b15c65

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db

MD5 4f8ed68a1863e3de221ca90c9db96a37
SHA1 0effcbe7e22b3a3856830a47b66f5e833e79d209
SHA256 332e18f95250354a2ac9a397ab2791b3688ef1119425aebe4210c5f41313cbe6
SHA512 a6332f6eb959bba060da0779e497715351e5fa25a881db18b09c0b3862808cc2d9489bf1032540964f73ca0651049843aaa60b1a27354614626ca0abf3c55996

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db

MD5 b445395f1aa641fbc3815509a2abe933
SHA1 0c9b55d1746a04f3bf36da6e77fa464d34cc5ce4
SHA256 0ae20207259bc0ffcf68260fed844944bd47e07fa405a77dc5c8762cef734b1d
SHA512 81c15259d644bdc6996fecab1c65ca99cba0eee706188e81bf2a40cef55c9ce9e1c27ac6a0606d8fedbc079110e59ba827ff70cdd942e46f12dad1c80b660351

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db

MD5 a1732749e4de326d153f0ee6b566ebe8
SHA1 0599976e7e9f044880513808adf860d635bbeaf6
SHA256 6ba5e1679843c3843f7ad66ff95993f11229dbd257e75aaa2b4ab984c8382b64
SHA512 bb9e376c00be79f0a36546e42646145524424d94b30a909cc9863b70eb0b669e240fab68d48be79ee23d934b1d3ae41adb003d0fbd9cf32fe9a4dba065f2c5b5

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-17 14:30

Reported

2024-04-17 20:52

Platform

win7-20240215-en

Max time kernel

1791s

Max time network

1558s

Command Line

"C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe"

Signatures

Troldesh, Shade, Encoder.858

ransomware trojan troldesh

Deletes shadow copies

ransomware

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\37D02F4437D02F44.bmp" C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\settings.js C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\clock.js C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\flyout.html C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\settings.js C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_pressed.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\currency.css C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_Off.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-search.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\2.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\icon.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\settings.css C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous_partly-cloudy.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\7-Zip\7-zip.chm C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\settings.html C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\RSSFeeds.js C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_hov.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_dot.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_hover.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_s.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_snow.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\RSSFeeds.js C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\adcvbs.inc C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\RSSFeeds.css C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_floating.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\31.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\localizedStrings.js C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\cpu.js C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\42.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dialdot.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\ C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2416 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 2416 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 2416 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 2416 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 2416 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 2676 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 2676 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 2676 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 2676 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 2676 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 2676 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 2676 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 2676 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 2676 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 2676 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 2676 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 2676 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

"C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe"

C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

C:\Windows\system32\vssadmin.exe

C:\Windows\system32\vssadmin.exe List Shadows

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssadmin.exe

C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssadmin.exe

C:\Windows\system32\vssadmin.exe List Shadows

Network

Country Destination Domain Proto
AT 86.59.21.38:443 tcp
N/A 127.0.0.1:49203 tcp
US 128.31.0.39:9101 tcp
US 154.35.32.5:443 tcp
US 208.83.223.34:80 tcp
SG 76.73.17.194:9090 tcp

Files

memory/2416-0-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2416-1-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2416-4-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2416-7-0x0000000000360000-0x0000000000394000-memory.dmp

memory/2416-8-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2416-13-0x0000000004A30000-0x0000000004C5A000-memory.dmp

memory/2416-12-0x0000000000360000-0x0000000000394000-memory.dmp

memory/2416-11-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2676-17-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-14-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-18-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-19-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-20-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-21-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-22-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-23-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-26-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-27-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-28-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-29-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-30-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-31-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-32-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-33-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-34-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-35-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-36-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-37-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-38-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-39-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-40-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-41-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-42-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-43-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-44-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-45-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-46-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-47-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-48-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-49-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-50-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-51-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-52-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-53-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-54-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-55-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-56-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-57-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-58-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-59-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-60-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-61-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-62-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-63-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-64-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-65-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-66-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-67-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-68-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-69-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-70-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-71-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-72-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-73-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-74-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-75-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-76-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-77-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-78-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2676-79-0x0000000000400000-0x0000000000608000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-04-17 14:30

Reported

2024-04-17 20:53

Platform

win10-20240404-en

Max time kernel

1803s

Max time network

1603s

Command Line

"C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe"

Signatures

Troldesh, Shade, Encoder.858

ransomware trojan troldesh

Deletes shadow copies

ransomware

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened (read-only) \??\D: C:\Windows\explorer.exe N/A
File opened (read-only) \??\F: C:\Windows\explorer.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\0AEC3A620AEC3A62.bmp" C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCache-Light.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\TEE\it-IT.Messaging.config C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-150_contrast-black.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-100_contrast-high.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\MedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Outlook.scale-250.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-256.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\1113_20x20x32.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\4613_20x20x32.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\tg.txt C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\contrast-black\Movie-TVStoreLogo.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-128.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailBadge.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\WideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\video.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Aquarium\aquarium_10h.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxWideTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\StopwatchSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\ExchangeSmallTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\8794_20x20x32.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\kiss.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\CardBacks\Western.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\MainPageState2\tripeaks_bp_920.jpg C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\LargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-96_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-256.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\western_13c.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Resources\TopicPage\Images\playbutton-rollover.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageMedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\vc_16x11.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\cw_16x11.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\mn_60x42.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionWideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\MedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ls_16x11.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\wfh.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\CoreEngine\Data\BrushProfile\TrailMask.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_LogoSmall.targetsize-48.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\MedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256_altform-colorize.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-96.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\it.txt C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-white\MusicStoreLogo.scale-150_contrast-white.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-30_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6478_20x20x32.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\1949_24x24x32.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PeopleMedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\RunningLate.scale-64.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-24.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-72.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rescache\_merged\1601268389\715946058.pri C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
File created C:\Windows\rescache\_merged\4032412167\4002656488.pri C:\Windows\explorer.exe N/A
File opened for modification C:\Windows\ C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File created C:\Windows\rescache\_merged\2717123927\1590785016.pri C:\Windows\explorer.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 C:\Windows\explorer.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "0" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133567067019138555" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "0" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e80704004100720067006a006200650078002000200032000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000c63dc4260791da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80704004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000d73fa5260791da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e80704004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc7600000000000000000000000088d27c708a86da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "129" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56" C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5088 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 5088 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 5088 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 5088 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 3292 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 3292 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 3292 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 3292 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 3292 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 3292 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

"C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe"

C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

C:\Windows\system32\vssadmin.exe

C:\Windows\system32\vssadmin.exe List Shadows

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssadmin.exe

C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssadmin.exe

C:\Windows\system32\vssadmin.exe List Shadows

C:\Windows\explorer.exe

explorer.exe

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe

"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.2.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 8.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
N/A 127.0.0.1:49811 tcp
US 154.35.32.5:443 tcp
DE 131.188.40.189:443 tcp
US 8.8.8.8:53 189.40.188.131.in-addr.arpa udp
US 8.8.8.8:53 241.197.17.2.in-addr.arpa udp
US 128.31.0.39:9101 tcp
US 8.8.8.8:53 71.121.18.2.in-addr.arpa udp
NL 194.109.206.212:443 tcp

Files

memory/5088-0-0x0000000000400000-0x000000000062A000-memory.dmp

memory/5088-1-0x0000000000400000-0x000000000062A000-memory.dmp

memory/5088-2-0x0000000000400000-0x000000000062A000-memory.dmp

memory/5088-3-0x0000000000400000-0x000000000062A000-memory.dmp

memory/5088-4-0x0000000000400000-0x000000000062A000-memory.dmp

memory/5088-5-0x0000000000400000-0x000000000062A000-memory.dmp

memory/5088-6-0x0000000000400000-0x000000000062A000-memory.dmp

memory/5088-7-0x0000000000400000-0x000000000062A000-memory.dmp

memory/5088-8-0x0000000000400000-0x000000000062A000-memory.dmp

memory/5088-9-0x0000000000400000-0x000000000062A000-memory.dmp

memory/5088-10-0x0000000000400000-0x000000000062A000-memory.dmp

memory/5088-11-0x0000000000400000-0x000000000062A000-memory.dmp

memory/5088-12-0x0000000000400000-0x000000000062A000-memory.dmp

memory/5088-13-0x0000000000400000-0x000000000062A000-memory.dmp

memory/5088-16-0x0000000000400000-0x000000000062A000-memory.dmp

memory/5088-19-0x00000000024E0000-0x0000000002514000-memory.dmp

memory/3292-20-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-21-0x0000000000400000-0x0000000000608000-memory.dmp

memory/5088-22-0x0000000000400000-0x000000000062A000-memory.dmp

memory/5088-24-0x00000000024E0000-0x0000000002514000-memory.dmp

memory/3292-23-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-28-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-29-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-30-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-31-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-32-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-33-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-34-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-37-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-38-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-39-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-40-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-41-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-42-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-43-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-44-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-45-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-46-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-47-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-48-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-49-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-50-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-51-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-52-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-53-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-54-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-55-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-56-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-57-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-58-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-59-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-60-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-61-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-62-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-63-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-64-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-65-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-66-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-67-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-68-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-69-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-70-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-71-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-72-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-73-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-74-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-75-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-76-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-77-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-78-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3292-79-0x0000000000400000-0x0000000000608000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

MD5 75430994a9d6eb12d7d466adc7721020
SHA1 0f304f258fec9553341dffe96b752e9e086d265b
SHA256 39a780d6a9729f61a05bec79ae999168eaab1a60ad23ba6e63387fc084f1f142
SHA512 7ddda9b9d99cb59f11b079830268ad750b99c8368cffa00e552197816b829e307d2879d039023485ab6a5c21df7627376376c31a81966ea5dcad130848b18b8c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db

MD5 f5fef41e3d9b7053177844b3f94d8b61
SHA1 c0c6384f2e0b56c6ac0b999d8584a2bc9509d20e
SHA256 68431ab4b4a76a1a635df107e402a68d272c88729c157e5de0fbdf84523b879e
SHA512 7039fbe40f264b4a79df4219fbee8952ad0d05a2501cf9ca5cfd28adc86558dc6df1a2568e486d06b6f50566f1ce74b7b9d0796891b5d1dbabcf077fa7dbd885

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

MD5 ac55afa8805451ed8c829f69e33b915f
SHA1 222d0bc164ee75a1b80db462c077b27627a517db
SHA256 a2217c7cd4035accbbbd9ae962db7b30e20bbe08b044b3262c3e9bff560b6474
SHA512 2efe7edc68748db50e3105528045562e062371b5553f2437b0bdd39a156b4be7d4edbbdd9f60c69c92dfe337852a44b84fcda8dacf0ace5fbe468ff93b04b8d8

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db

MD5 ae6fbded57f9f7d048b95468ddee47ca
SHA1 c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA256 d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
SHA512 f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

C:\ProgramData\System32\xfs

MD5 5d020c50f963a22db14e5f247e7c3079
SHA1 c77dbdc5e519ac69cebd4fe921365587942d3069
SHA256 d8caebb5ceb75cedc4d2677b995ad1a8936fe5e9e696d9387ac8ae8c85e1ddb7
SHA512 a09d9e39a95ccee9864e64bcd6a61fbdabdf881770930c8a74f56c17843f02a7e179a69fb63d145440f6ec677445bd945cd0da2a554bc549efe4dad73496a664

C:\Users\Admin\AppData\Roaming\0AEC3A620AEC3A62.bmp

MD5 993cc909a89f0fb7fe90acc3703c2105
SHA1 f422cdcb426718b235a19080b0daf71c9b448768
SHA256 4aa6cdb9ce95410f85a05b21967d224cfd49cf8c7fa18d9998304a16d4e4b5d8
SHA512 5ec562b1e6f91f8774bf8fd00a6a413b4b4b5be2ede17ff9c417fce7097b7d313b136740e525c19a77f220e80fb0e92f8f4d1866ea185c9fc6755c3b41aa9762

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db

MD5 6f9599bb9f80bae4b496aeeb4428118f
SHA1 a31beff0f9e07103d873bca51a9fcf5c7884ceb3
SHA256 0d33335e6c68e79d757546686988e0c34e9f10b40ae2bd6ca6635557e668b34b
SHA512 203b368d1b13785515034348097d0ce1516d0e7ac5ad073fdd383ff056b145f28fe44d5f8a970e3769abcdc651abb7cd95fef983f086d28b1cd3c7250a12b17c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

MD5 b11789aff4cf5efe6bf001345d18c47d
SHA1 86971412a049e2397709d0aa6f25a3acf82d007a
SHA256 44a2e81c9fdd22765e7dd395b68f8ece015c3ea5f67a10b5b3f033f6df3885c9
SHA512 b6522f132b2d8d9b6591dab82b11d7759438a14f2d32bc2db278f5517d7a562e7f4630d9a96023801026d894bc5201ba1cd776e6c5dc32cfd880ec9bc151eff1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

MD5 efbe7b9d7f45f8d50d1ccb6135a1ead8
SHA1 28a012b7a1735aa8edd83a5dae131abf603c5055
SHA256 ae5d02600316a7ab4bb5a62a68dc0168d9f52c1743c976ae7f148ca5b3c65314
SHA512 afe783eb3f94d0759063c4bbeb7e44884d3b302642c619f470353b04efee121117c7736f49cbdecfdb83d879426fe6006189250923e3240c7876239a60ff2531

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db

MD5 f9ea165c2370bfb8f9ed4d8bda861226
SHA1 7338ab4191d84b2425bdbdab037332d6842ce978
SHA256 be4c85781e9f49a256f5765758ebed9b79cd80bb4381b0c06a8afc04414b93d1
SHA512 c2aef4aed5a2283251d8e4dd6ff03a9e68edc21642f96882c1fe95f3dfa45c331d479b50bc0515bfd811950f8e1aa909c4b6a0dfc8b14b1e451eb5d378ad4131

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db

MD5 df9e340469f86b3766c7ebe034e1bfc8
SHA1 f5b63289099c6c7e7b84bda13fa621b59cd2da4d
SHA256 958dace4d84fd42bcd03b42555384ef4f3f0243ebf234a402470ce6913432190
SHA512 dcd6c30656954e3551c73249d7bb8805b7c4e39c18164bcd1e67026c566b4effbf28da046019b2a0037743308ebd24a93f598c766b9f7a250d454f4072f2d1d3

Analysis: behavioral4

Detonation Overview

Submitted

2024-04-17 14:30

Reported

2024-04-17 20:56

Platform

win10v2004-20240412-en

Max time kernel

1797s

Max time network

1490s

Command Line

"C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe"

Signatures

Troldesh, Shade, Encoder.858

ransomware trojan troldesh

Deletes shadow copies

ransomware

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\A3AC5DE7A3AC5DE7.bmp" C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\WorldClockWideTile.contrast-white_scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-36_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-20_altform-colorize.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-standard\theme-light\Settings.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\SmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.scale-400.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-16_contrast-black.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-125_contrast-high.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\LockScreenBadgeLogo.scale-125.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchStoreLogo.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\MixedRealityPortalStoreLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_contrast-white.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\AgentPlaceholder.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-72_contrast-white.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-32_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-36_altform-fullcolor.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe.config C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-black_scale-125.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-72_contrast-black.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\MoveToFolderToastQuickAction.scale-80.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\TimerLargeTile.contrast-black_scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageMedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Exchange.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-30.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\LargeTile.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailSmallTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-lightunplated_devicefamily-colorfulunplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeBadge.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalMedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN044.XML C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-60.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-48_altform-fullcolor.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\listening.slk C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryResume.dotx C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-125.HCWhite.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-16_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\7739_20x20x32.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-32.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-48_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-24.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\ C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-553605503-2331009851-2137262461-1000\{1B5859C8-3A14-4139-8AA1-885592533774} C:\Windows\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 116 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 116 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 116 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 116 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 3552 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 3552 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 3552 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 3552 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 3552 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 3552 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

"C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe"

C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

C:\Windows\system32\vssadmin.exe

C:\Windows\system32\vssadmin.exe List Shadows

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssadmin.exe

C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssadmin.exe

C:\Windows\system32\vssadmin.exe List Shadows

C:\Windows\explorer.exe

explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 216.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 21.121.18.2.in-addr.arpa udp
DE 131.188.40.189:443 tcp
N/A 127.0.0.1:58815 tcp
US 8.8.8.8:53 189.40.188.131.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
DE 193.23.244.244:443 tcp
US 8.8.8.8:53 244.244.23.193.in-addr.arpa udp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp
AT 86.59.21.38:443 tcp
US 208.83.223.34:80 tcp
US 8.8.8.8:53 163.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 154.173.246.72.in-addr.arpa udp
NL 23.62.61.162:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 162.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/116-0-0x0000000000400000-0x000000000062A000-memory.dmp

memory/116-1-0x0000000000400000-0x000000000062A000-memory.dmp

memory/116-2-0x0000000000400000-0x000000000062A000-memory.dmp

memory/116-5-0x0000000000400000-0x000000000062A000-memory.dmp

memory/116-6-0x0000000000400000-0x000000000062A000-memory.dmp

memory/116-9-0x00000000033B0000-0x00000000033E4000-memory.dmp

memory/3552-10-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-11-0x0000000000400000-0x0000000000608000-memory.dmp

memory/116-12-0x0000000000400000-0x000000000062A000-memory.dmp

memory/116-14-0x00000000033B0000-0x00000000033E4000-memory.dmp

memory/3552-13-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-18-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-19-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-20-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-21-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-22-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-23-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-24-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-27-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-28-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-29-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-30-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-31-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-32-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-33-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-34-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-35-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-36-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-37-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-38-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-39-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-40-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-41-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-42-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-43-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-44-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-45-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-46-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-47-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-48-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-49-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-50-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-51-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-52-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-53-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-54-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-55-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-56-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-57-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-58-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-59-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-60-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-61-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-62-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-63-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-64-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-65-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-66-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-67-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-68-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-69-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-70-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-71-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-72-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-73-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-74-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-75-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-76-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-77-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-78-0x0000000000400000-0x0000000000608000-memory.dmp

memory/3552-79-0x0000000000400000-0x0000000000608000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-04-17 14:30

Reported

2024-04-17 20:56

Platform

win11-20240412-en

Max time kernel

1799s

Max time network

1516s

Command Line

"C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe"

Signatures

Troldesh, Shade, Encoder.858

ransomware trojan troldesh

Deletes shadow copies

ransomware

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened (read-only) \??\D: C:\Windows\explorer.exe N/A
File opened (read-only) \??\F: C:\Windows\explorer.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\9ED057A69ED057A6.bmp" C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsSplashScreen.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\AdCloseButton.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsNotepad_10.2102.13.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\NotepadLargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ko.txt C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\PersonaCoin.js C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-16_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-16_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-24_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\NewsAppList.targetsize-30_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_contrast-black.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Wide310x150Logo.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-30.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\NotepadSmallTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Light.scale-250.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintAppList.targetsize-80_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\cardflipped.dat C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@fluentui\dom-utilities\lib-commonjs\getParent.js C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-48_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadSmallTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-80_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\dom\elementContains.js C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreSplashScreen.scale-100_altform-colorful_theme-light.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeWideTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-60_contrast-white.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\initials.js C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\FocusZone.js C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Outlook.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintAppList.targetsize-30_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherAppList.targetsize-20_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.White.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\DocumentCard\DocumentCard.types.js C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\WideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-80.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_contrast-white.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Xbox_UnplatedLargeTile.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\ChoiceGroupOption.js C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailBadge.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsAppList.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\Assets\Square44x44Logo.targetsize-16_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Images\Square44x44Logo.scale-200.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-256.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarMediumTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\warn\warnDeprecations.js C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\SmallTile.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\FeedbackHubSplashScreen.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\SnipSketchAppList.targetsize-16_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Xbox_UnplatedLargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\Assets\Square44x44Logo.targetsize-256_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SnipSketchStoreLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Media Renderer\avtransport.xml C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Store\SplashScreen.scale-125.altform-colorful.png C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\ C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\explorer.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-243033537-3771492294-1461557691-1000\{1FD88852-3909-4880-8C2E-88DFABC78420} C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000200000014000000494c2006020004002c0010001000ffffffff2110ffffffffffffffff424d360000000000000036000000280000001000000040000000010020000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff00000060000000000000000000000020000000b0000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000060000000200000000000000020000000f00d0d0df09d9d9dffc8c8c8ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff000000603f3f3f66000000ff00000060000000900a0a0af0c0c0c0ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660e2e2e2ff474747eb000000d0000000e04c4c4cee999999ff939393eeb1b1b1f0e0e0e0ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660c8c8c8f7adadadf6858585ff000000ff000000ff737373ff999999ff999999ff999999ff999999ffa0a0a0e8868686ff000000ff000000606d6d6d88aaaaaaebb2b2b2ffb2b2b2ff7a7a7aff000000ff000000ff696969ff999999ff999999ff999999ff999999ff5f5f5fff000000ff0000006045454571b2b2b2ffb2b2b2ffb2b2b2ffa7a7a7ff1b1b1be8000000c0000000b0080808f08f8f8fff999999ff999999ff5f5f5fff000000ff00000060303030607f7f7fff7b7b7bf67e7e7ee2525252e20a0a0af0000000f00000003000000020000000f0101010eb5a5a5af6505050ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff676767ff000000ff000000b000000020000000000000000000000020000000b0000000ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff777777ff080808f0000000d0000000000000000000000000000000000000000000000060000000ff00000060000000602c2c2ceb5f5f5fff5f5f5fff3f3f3fee080808f0000000f0000000300000000000000000000000000000000000000000000000a0000000600000000000000050000000b0000000f0000000ff000000f0000000a000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff00000060000000000000000000000020000000b0000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000060000000200000000000000020000000f00d0d0df09d9d9dffc8c8c8ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff000000603f3f3f66000000ff00000060000000900a0a0af0c0c0c0ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660e2e2e2ff474747eb000000d0000000e04c4c4cee999999ff939393eeb1b1b1f0e0e0e0ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660c8c8c8f7adadadf6858585ff000000ff000000ff737373ff999999ff999999ff999999ff999999ffa0a0a0e8868686ff000000ff000000606d6d6d88aaaaaaebb2b2b2ffb2b2b2ff7a7a7aff000000ff000000ff696969ff999999ff999999ff999999ff999999ff5f5f5fff000000ff0000006045454571b2b2b2ffb2b2b2ffb2b2b2ffa7a7a7ff1b1b1be8000000c0000000b0080808f08f8f8fff999999ff999999ff5f5f5fff000000ff00000060303030607f7f7fff7b7b7bf67e7e7ee2525252e20a0a0af0000000f00000003000000020000000f0101010eb5a5a5af6505050ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff676767ff000000ff000000b000000020000000000000000000000020000000b0000000ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff777777ff080808f0000000d0000000000000000000000000000000000000000000000060000000ff00000060000000602c2c2ceb5f5f5fff5f5f5fff3f3f3fee080808f0000000f0000000300000000000000000000000000000000000000000000000a0000000600000000000000050000000b0000000f0000000ff000000f0000000a000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff0000fff90000fff10000800100000000000000000000000000000000000000000000000000000001000080070000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000800100000000000000000000000000000000000000000000000000000001000080070000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000002000000040000002400000001000000000000000100000000000000 C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 140000000700000001000100050000001400000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000e8070400420061007200510065007600690072000a004100620067002000660076007400610072007100200076006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000d453e1c5e98cda0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-243033537-3771492294-1461557691-1000\{11623CF9-8CB9-49BD-9ACC-943FA4FEC312} C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133574073096965705" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2484 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 2484 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 2484 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 2484 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
PID 2356 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 2356 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 2356 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 2356 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 2356 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 2356 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe C:\Windows\system32\vssadmin.exe
PID 2236 wrote to memory of 4416 N/A C:\Windows\system32\sihost.exe C:\Windows\explorer.exe
PID 2236 wrote to memory of 4416 N/A C:\Windows\system32\sihost.exe C:\Windows\explorer.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

"C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe"

C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe

C:\Windows\system32\vssadmin.exe

C:\Windows\system32\vssadmin.exe List Shadows

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssadmin.exe

C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssadmin.exe

C:\Windows\system32\vssadmin.exe List Shadows

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\explorer.exe

explorer.exe /LOADSAVEDWINDOWS

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
N/A 127.0.0.1:49751 tcp
SE 171.25.193.9:80 tcp
NL 194.109.206.212:443 tcp
US 128.31.0.39:9101 tcp
NL 23.62.61.72:443 www.bing.com tcp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
NL 23.62.61.72:443 www.bing.com tcp
NL 23.62.61.72:443 www.bing.com tcp
NL 23.62.61.72:443 www.bing.com tcp
NL 23.62.61.72:443 www.bing.com tcp
DE 193.23.244.244:443 tcp
NL 23.62.61.152:443 www.bing.com tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/2484-0-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2484-1-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2484-2-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2484-3-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2484-4-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2484-5-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2484-6-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2484-7-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2484-8-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2484-9-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2484-10-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2484-11-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2484-14-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2484-17-0x0000000003370000-0x00000000033A4000-memory.dmp

memory/2356-20-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2484-19-0x0000000000400000-0x000000000062A000-memory.dmp

memory/2356-22-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2484-21-0x0000000003370000-0x00000000033A4000-memory.dmp

memory/2356-18-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-26-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-27-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-28-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-29-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-30-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-31-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-32-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-33-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-36-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-37-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-38-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-39-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-40-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-41-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-42-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-43-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-44-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-45-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-46-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-47-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-48-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-49-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-50-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-51-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-52-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-53-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-54-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-55-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-56-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-57-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-58-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-59-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-60-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-61-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-62-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-63-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-64-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-65-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-66-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-67-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-68-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-69-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-70-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-71-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-72-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-73-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-74-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-75-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-76-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-77-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-78-0x0000000000400000-0x0000000000608000-memory.dmp

memory/2356-79-0x0000000000400000-0x0000000000608000-memory.dmp

C:\ProgramData\System32\xfs

MD5 90c4396aa90bcff93925da80c40eec7d
SHA1 2e18c728ecea016a4a3cd162ecd5eb78afa03fd8
SHA256 fa1337a2f7dc2f2feb59ff839347f61b21c21c6c59da97be8adbe8f294e2f3b2
SHA512 be717dfd0d60f790b13b0bf7ecb0ce668e2a42384f140d3b77ab856c1c835f8f73c55f8660c552b265b5dfbfb202d3a3ee4b7f5d3f5b7832f2675d7e6aa34fd7

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db

MD5 419a089e66b9e18ada06c459b000cb4d
SHA1 ed2108a58ba73ac18c3d2bf0d8c1890c2632b05a
SHA256 c48e42e9ab4e25b92c43a7b0416d463b9ff7c69541e4623a39513bc98085f424
SHA512 bbd57bea7159748e1b13b3e459e2c8691a46bdc9323afdb9dbf9d8f09511750d46a1d98c717c7adca07d79edc859e925476dd03231507f37f45775c0a79a593c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

MD5 5e654a5b94d8bd3712cc361adf122482
SHA1 1f89fee499995d781342e92250eed407e33f14a2
SHA256 93013c9daba885c1283a51c5f0ea20436407770237f8b90ebd95ab60ccf26366
SHA512 4827ce70cd580120360b10bee39cdd91116f1c37cb6801e92fbad78beb7c4f0bfdfde4ced7e01891f92b5c54731e5862f17d74e58a0ff87d8dd354a2bf21d32f

C:\Users\Admin\AppData\Roaming\9ED057A69ED057A6.bmp

MD5 993cc909a89f0fb7fe90acc3703c2105
SHA1 f422cdcb426718b235a19080b0daf71c9b448768
SHA256 4aa6cdb9ce95410f85a05b21967d224cfd49cf8c7fa18d9998304a16d4e4b5d8
SHA512 5ec562b1e6f91f8774bf8fd00a6a413b4b4b5be2ede17ff9c417fce7097b7d313b136740e525c19a77f220e80fb0e92f8f4d1866ea185c9fc6755c3b41aa9762

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db

MD5 11ae612cb19da75ad54549a9690db99a
SHA1 b44f9fc4ce5684300868a1611f64f71ea514865f
SHA256 751bb02ddffafce04230550655eb738d861ee4787fe7971a3757516fee41773a
SHA512 0abb1ff83e5e3c28a58a9b6bc6f98987573679be8c82a96b27db490c11a3e0f1f47aef4ef65d41d8bd3c4d53ec48bfa61787998dc25534c1f2276a733853ee78

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

MD5 fcd9c071663797458ddd588e3955490b
SHA1 4699a3e531e03953718496ae04a70355710d756a
SHA256 876e87ae2d94ec57b5080030439ab5bb55b3a41ea2224430a25e1f31aadef6e1
SHA512 3523423e469524a69cc3c2a20dc82a4c5e301cb957052d1e519a60e1d4d6a818f361a758549e5fe95e78caffbe338cab0721c5a522ad4fceef985061beab1b1e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db

MD5 ae6fbded57f9f7d048b95468ddee47ca
SHA1 c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA256 d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
SHA512 f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat

MD5 eec497b5b1b5d7809cf37cbacd787108
SHA1 fb8708dd2fc4bc67548a366f618c41dc45dee3fb
SHA256 6cec6efc1c0d59bd8208bcaf08e176537aad59f38a68534fe4142905429733e6
SHA512 8cc18a441e8b92eb86c1c21eabe4f994f4b42f57e71afdb503c6a391b6c031d154b394ffcada28718cb0c26209fe25d5281d4ec4d3ee0d7a785b981108e72f36

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133578603745668128.txt

MD5 65d939ef67bf440d30c8dee4eebe4890
SHA1 5aa8c724f2e458d7c7c6fe7bd6daf0f48b13fc40
SHA256 e7abcd543a39be760c610fb1cd8a101abfffc6002e47aaf7dea39b31f94a3531
SHA512 8237d8dcab2898614b13f052ca540e6f094b7eb4653a110b572967b3fd34c5d29982cb1ada9a4e38702d08cf736c684ae8269aeac55f0fcbcc2d5b04dfbb50e7

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat

MD5 d5d3faf43b19015e8921755d52911ce6
SHA1 4102ebcafd6c49f261620d317c87f11714010ff1
SHA256 d9906bd55f73e473e5b819d421f26421e5f4c8811f95003f970dee30ae964c3c
SHA512 7d6a715267cf43155592b1bb9e077e6989c2f8c1996c8224ac117b74a701e59f7296cdfdd76b019029fc8971531a87aa48d2b8cbeeb4a31bc745fc71cd8d0054

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db

MD5 95b6ac70696afe7a8e55ec735dd16400
SHA1 5702f4a25f64f393bb2bb60df4a3bf2b74f4e292
SHA256 0959d359562b69758e43602c8915bbe11383f0d842574f44425f287295103c24
SHA512 3270a28b35cbd8348af4e76cbf305a1d8a2787db91fcd542a19c91833e6432e89ea1dfb59744aecc744761b7eb975f7c31c92d401869623d7a4a1da6b5c8a5e6

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat

MD5 5902e0994d3b8e5eefe6c49430157a93
SHA1 6e3c3b605ee6145befa98e607b71bfddb91b5f4e
SHA256 07f31cc4386167f2f01fcee8345d7a2b99fa347c1a4dc7c470ce1d411d058694
SHA512 e02dc5829f7fe2a1a1bd5a682e386c6c8a5e709b94204ca4f2191100457facc1d02c5e36fba81be955ace78e1291b357a0c76c4ddb1e9933a1fab7a46147f698

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db

MD5 be195af7f57b48e3e12cdf357c6169a2
SHA1 5d8b0be8c34e991ed25519a99ec64838bd2f2056
SHA256 7fe307ad61856ee8dd10cb90b2930d21605f757acebeb60d2c67e09542d0aa4c
SHA512 04a7254ae7c42483ebae07c4d4b089e9ad2d35166e40b31f4412dbbd7eef5bf3e8bdd6608da3b723323d53d29165a585e3dd947b175e84c32863a10646ae067c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

MD5 06593527b81dcd543714adfcc7291dab
SHA1 7d57a0138c7bd8e4a930f7db4836b317bda1b203
SHA256 ec4ddc686321e3de541c44e7cf07042ce86043794b910b7abdec5da13e41e6d6
SHA512 4ed775556e4bdc4c6d7c0eecb6defcbd4fad0afe790cd65faa0c76a6aea2fac2f7c7eff6c1b2d3bca73a0016e74e1105f354c5846c66a29915df34934e067359

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

MD5 1bce34fb5390500f9d4fb384a5232188
SHA1 35a1e99ead99d2dd1a8d1f62ab71050ee70e33de
SHA256 6a65b566a92fb4bdfb1c1707c79e8575c3e8a3d60ed219a07c1bf4bb40d51911
SHA512 b8261427badb74b9b359aab804c6c4aa8b477c408f66a10f0298994c22331643929ab3d16ba6b733738e453e1d78bba1ebcc91a04d54c72c636fe15d83e2cbd0

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db

MD5 1cdc0ffd2c431a35cc6e71cc7957691a
SHA1 e1ad189050008e41b5a96db0db7db9cb48fbe623
SHA256 0d119fb83a6f22252a4c27de88734bc062441813fb7f7603357c73cf81aad1dc
SHA512 635fd7a12f724f4b91cf249989c47f6a9494e0fa838b048d38264dd590c0fc5ec9ba470bbbca86f2db63427e9d5a1ed65b5164c0dbb5720c24071f3c9e108e02

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db

MD5 7cc03322ed8facd1a22484971864abca
SHA1 3d0467197ebba4c6e29aff7ca488d0f38fc1e4df
SHA256 37ab05149f1ee0370b5770f856dbebf41ae4d597d9ad3379f7fa8ffa8a21398a
SHA512 583ad7394d1593b087e240753f48b8b29baded004693fc75f499dff865bcfc533569a4188c4997e019c8b7fb1e7ee68aa47197031afbaf05aa9d2e3fec5eed38

C:\ProgramData\Windows\csrss.exe

MD5 6599f79e40a26186261b58aa89194e5b
SHA1 0a44b71f930447d545de0f10b6f9c70d513acacc
SHA256 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02
SHA512 9e4c8b704bdf6f69df693c40c323f069ac7b9900ab8486d7e5a8423670aa1ee686ccfb6c4026f903d0928145efeee04b0b4cded0000f918862208baba9913748