Overview

overview

10

Static

static

10

IN.exe

windows7-x64

10

IN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    156s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13-10-2023 14:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    IN.exe

  • Size

    340KB

  • MD5

    714870c33ba84e744b84b32e6e114ed9

  • SHA1

    840f442d4466713becdf72b88846871330ac38e7

  • SHA256

    51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51

  • SHA512

    270c584cc9f696de3421429627a07bfbd7829a033cfdc16280e7e233e8ae09e2f1cd0341537a6b050811683d93a14a1465aa3ab96e9577c98ebea521faae65f2

  • SSDEEP

    6144:PNs9prB0CnszdPZxMzk1ukSXa9bnuDOeFdGpBP7ENf3zcfUE:y9RaPZxMzk1uBXa9bu2JeAfUE

Score
10/10
evasionpersistenceransomware

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\es-ES\HOW_TO_BACK_FILES.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; word-break: break-all; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">{{IDENTIFIER}}</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (7554) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes System State backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes system backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 14 IoCs
    evasion
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1204
      • C:\Users\Admin\AppData\Local\Temp\IN.exe
        "C:\Users\Admin\AppData\Local\Temp\IN.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Adds Run key to start application
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1916
        • C:\Windows\SysWOW64\cmd.exe
          \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill \"SQL\"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1892
          • C:\Windows\system32\cmd.exe
            C:\Windows\sysnative\cmd.exe /c rem Kill \"SQL\"
            4⤵
              PID:2560
          • C:\Windows\SysWOW64\cmd.exe
            \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3024
            • C:\Windows\system32\cmd.exe
              C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2688
              • C:\Windows\system32\taskkill.exe
                taskkill -f -im sqlbrowser.exe
                5⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2872
          • C:\Windows\SysWOW64\cmd.exe
            \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2712
            • C:\Windows\system32\cmd.exe
              C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1588
              • C:\Windows\system32\taskkill.exe
                taskkill -f -im sql writer.exe
                5⤵
                • Kills process with taskkill
                PID:2640
          • C:\Windows\SysWOW64\cmd.exe
            \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2840
            • C:\Windows\system32\cmd.exe
              C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1592
              • C:\Windows\system32\taskkill.exe
                taskkill -f -im sqlserv.exe
                5⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2632
          • C:\Windows\SysWOW64\cmd.exe
            \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2460
            • C:\Windows\system32\cmd.exe
              C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2532
              • C:\Windows\system32\taskkill.exe
                taskkill -f -im msmdsrv.exe
                5⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2544
          • C:\Windows\SysWOW64\cmd.exe
            \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2984
            • C:\Windows\system32\cmd.exe
              C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2132
              • C:\Windows\system32\taskkill.exe
                taskkill -f -im MsDtsSrvr.exe
                5⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1492
          • C:\Windows\SysWOW64\cmd.exe
            \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
            3⤵
              PID:2160
              • C:\Windows\system32\cmd.exe
                C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
                4⤵
                  PID:564
                  • C:\Windows\system32\taskkill.exe
                    taskkill -f -im sqlceip.exe
                    5⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1012
              • C:\Windows\SysWOW64\cmd.exe
                \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
                3⤵
                  PID:1412
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
                    4⤵
                      PID:364
                      • C:\Windows\system32\taskkill.exe
                        taskkill -f -im fdlauncher.exe
                        5⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1804
                  • C:\Windows\SysWOW64\cmd.exe
                    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
                    3⤵
                      PID:2536
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
                        4⤵
                          PID:1460
                          • C:\Windows\system32\taskkill.exe
                            taskkill -f -im Ssms.exe
                            5⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2792
                      • C:\Windows\SysWOW64\cmd.exe
                        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
                        3⤵
                          PID:1572
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
                            4⤵
                              PID:944
                              • C:\Windows\system32\taskkill.exe
                                taskkill -f -im SQLAGENT.EXE
                                5⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2016
                          • C:\Windows\SysWOW64\cmd.exe
                            \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
                            3⤵
                              PID:1996
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
                                4⤵
                                  PID:1904
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill -f -im fdhost.exe
                                    5⤵
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1240
                              • C:\Windows\SysWOW64\cmd.exe
                                \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
                                3⤵
                                  PID:2768
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
                                    4⤵
                                      PID:2660
                                      • C:\Windows\system32\taskkill.exe
                                        taskkill -f -im ReportingServicesService.exe
                                        5⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1236
                                  • C:\Windows\SysWOW64\cmd.exe
                                    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
                                    3⤵
                                      PID:1672
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
                                        4⤵
                                          PID:956
                                          • C:\Windows\system32\taskkill.exe
                                            taskkill -f -im msftesql.exe
                                            5⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:952
                                      • C:\Windows\SysWOW64\cmd.exe
                                        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
                                        3⤵
                                          PID:2912
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
                                            4⤵
                                              PID:2764
                                              • C:\Windows\system32\taskkill.exe
                                                taskkill -f -im pg_ctl.exe
                                                5⤵
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2796
                                          • C:\Windows\SysWOW64\cmd.exe
                                            \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe
                                            3⤵
                                              PID:2296
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe
                                                4⤵
                                                  PID:2288
                                                  • C:\Windows\system32\taskkill.exe
                                                    taskkill -f -impostgres.exe
                                                    5⤵
                                                    • Kills process with taskkill
                                                    PID:1272
                                              • C:\Windows\SysWOW64\cmd.exe
                                                \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
                                                3⤵
                                                  PID:2432
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
                                                    4⤵
                                                      PID:836
                                                      • C:\Windows\system32\net.exe
                                                        net stop MSSQLServerADHelper100
                                                        5⤵
                                                          PID:2112
                                                          • C:\Windows\system32\net1.exe
                                                            C:\Windows\system32\net1 stop MSSQLServerADHelper100
                                                            6⤵
                                                              PID:2564
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS
                                                        3⤵
                                                          PID:1884
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS
                                                            4⤵
                                                              PID:1104
                                                              • C:\Windows\system32\net.exe
                                                                net stop MSSQL$ISARS
                                                                5⤵
                                                                  PID:1540
                                                                  • C:\Windows\system32\net1.exe
                                                                    C:\Windows\system32\net1 stop MSSQL$ISARS
                                                                    6⤵
                                                                      PID:1796
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW
                                                                3⤵
                                                                  PID:2348
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW
                                                                    4⤵
                                                                      PID:436
                                                                      • C:\Windows\system32\net.exe
                                                                        net stop MSSQL$MSFW
                                                                        5⤵
                                                                          PID:2880
                                                                          • C:\Windows\system32\net1.exe
                                                                            C:\Windows\system32\net1 stop MSSQL$MSFW
                                                                            6⤵
                                                                              PID:520
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS
                                                                        3⤵
                                                                          PID:2884
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS
                                                                            4⤵
                                                                              PID:2032
                                                                              • C:\Windows\system32\net.exe
                                                                                net stop SQLAgent$ISARS
                                                                                5⤵
                                                                                  PID:1476
                                                                                  • C:\Windows\system32\net1.exe
                                                                                    C:\Windows\system32\net1 stop SQLAgent$ISARS
                                                                                    6⤵
                                                                                      PID:1808
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW
                                                                                3⤵
                                                                                  PID:1424
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW
                                                                                    4⤵
                                                                                      PID:1584
                                                                                      • C:\Windows\system32\net.exe
                                                                                        net stop SQLAgent$MSFW
                                                                                        5⤵
                                                                                          PID:2832
                                                                                          • C:\Windows\system32\net1.exe
                                                                                            C:\Windows\system32\net1 stop SQLAgent$MSFW
                                                                                            6⤵
                                                                                              PID:980
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser
                                                                                        3⤵
                                                                                          PID:1284
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser
                                                                                            4⤵
                                                                                              PID:1816
                                                                                              • C:\Windows\system32\net.exe
                                                                                                net stop SQLBrowser
                                                                                                5⤵
                                                                                                  PID:2896
                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                    C:\Windows\system32\net1 stop SQLBrowser
                                                                                                    6⤵
                                                                                                      PID:1924
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS
                                                                                                3⤵
                                                                                                  PID:680
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS
                                                                                                    4⤵
                                                                                                      PID:1736
                                                                                                      • C:\Windows\system32\net.exe
                                                                                                        net stop REportServer$ISARS
                                                                                                        5⤵
                                                                                                          PID:908
                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                            C:\Windows\system32\net1 stop REportServer$ISARS
                                                                                                            6⤵
                                                                                                              PID:320
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter
                                                                                                        3⤵
                                                                                                          PID:2644
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\sysnative\cmd.exe /c net stop SQLWriter
                                                                                                            4⤵
                                                                                                              PID:3028
                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                net stop SQLWriter
                                                                                                                5⤵
                                                                                                                  PID:960
                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                    C:\Windows\system32\net1 stop SQLWriter
                                                                                                                    6⤵
                                                                                                                      PID:1388
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
                                                                                                                3⤵
                                                                                                                  PID:1464
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
                                                                                                                    4⤵
                                                                                                                      PID:888
                                                                                                                      • C:\Windows\system32\vssadmin.exe
                                                                                                                        vssadmin.exe Delete Shadows /All /Quiet
                                                                                                                        5⤵
                                                                                                                        • Interacts with shadow copies
                                                                                                                        PID:2532
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
                                                                                                                    3⤵
                                                                                                                      PID:2328
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
                                                                                                                        4⤵
                                                                                                                          PID:1524
                                                                                                                          • C:\Windows\system32\wbadmin.exe
                                                                                                                            wbadmin DELETE SYSTEMSTATEBACKUP
                                                                                                                            5⤵
                                                                                                                            • Deletes System State backups
                                                                                                                            PID:2260
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
                                                                                                                        3⤵
                                                                                                                          PID:2888
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
                                                                                                                            4⤵
                                                                                                                              PID:2920
                                                                                                                              • C:\Windows\system32\wbadmin.exe
                                                                                                                                wbadmin delete backup -keepVersion:0 -quiet
                                                                                                                                5⤵
                                                                                                                                • Deletes system backups
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:3064
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
                                                                                                                            3⤵
                                                                                                                              PID:2864
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
                                                                                                                                4⤵
                                                                                                                                  PID:2964
                                                                                                                                  • C:\Windows\system32\wbadmin.exe
                                                                                                                                    wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
                                                                                                                                    5⤵
                                                                                                                                      PID:2672
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                                                                                                  3⤵
                                                                                                                                    PID:1156
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                                                                                                      4⤵
                                                                                                                                        PID:2992
                                                                                                                                        • C:\Windows\system32\bcdedit.exe
                                                                                                                                          bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                                                                                                          5⤵
                                                                                                                                          • Modifies boot configuration data using bcdedit
                                                                                                                                          PID:2840
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
                                                                                                                                      3⤵
                                                                                                                                        PID:2976
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
                                                                                                                                          4⤵
                                                                                                                                            PID:2384
                                                                                                                                            • C:\Windows\system32\bcdedit.exe
                                                                                                                                              bcdedit.exe /set {default} recoverynabled No
                                                                                                                                              5⤵
                                                                                                                                              • Modifies boot configuration data using bcdedit
                                                                                                                                              PID:2464
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
                                                                                                                                          3⤵
                                                                                                                                            PID:2092
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
                                                                                                                                              4⤵
                                                                                                                                                PID:2356
                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                  wmic.exe SHADOWCOPY /nointeractive
                                                                                                                                                  5⤵
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:2652
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IN.exe
                                                                                                                                            \\?\C:\Users\Admin\AppData\Local\Temp\IN.exe -network
                                                                                                                                            2⤵
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            • System policy modification
                                                                                                                                            PID:1340
                                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                                          1⤵
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:1932

                                                                                                                                        Network

                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_F_COL.HXK
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          0ac71153dea6528304eaf4620aba2efc

                                                                                                                                          SHA1

                                                                                                                                          e61b1e16d4b1f5ddb7be65f83918c239834c74cd

                                                                                                                                          SHA256

                                                                                                                                          5bf45e2293c060543c8f3333db53c61cd4d9e2daa86a07b1ec76cab68837e1d8

                                                                                                                                          SHA512

                                                                                                                                          d9204fc763333949bf5768835d176e504194da0b72c52b9a727bb829e60e9e12b9adaf4e962ee25020281695e17313c31dd05eba8d2e6febde89e98a17ce96a4

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_K_COL.HXK
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          d934279f214841ec99fbe0982faa951a

                                                                                                                                          SHA1

                                                                                                                                          645e8e37dc7369c8e46f0b69c08a85ec2327c19c

                                                                                                                                          SHA256

                                                                                                                                          135cf11073ad57f95a7f396c052c6309bdb768c6e65c5269853ec6bd1fde1acd

                                                                                                                                          SHA512

                                                                                                                                          ec957a84f3499895c96b9572e5c7f64fcb3190f0f7ff3f332f06860c061a27a7d818ff929c1b7d262aa7eaa7471e4f15ea31cf024e72a4aa2bc09d8739428895

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\TAB_OFF.GIF.infected
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          ed135cb6744244a81cb7eb6966aaf1c6

                                                                                                                                          SHA1

                                                                                                                                          63f756d43cdb441942c727a9fb05fdceff5e3c66

                                                                                                                                          SHA256

                                                                                                                                          2550b2cd6e3e117ab7b56a841ebff25500da4fbd5085f822745a8811a846a415

                                                                                                                                          SHA512

                                                                                                                                          e7657b8f305063b959b8f4b71785db784e4b6576d55e664c0fecf14fa3090f95d4ce580a8e37275e9c539595026ab0e3394665d6b1916226598a87053d7689bb

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          90c87dbd80e56f2f25f4118d9efd41c6

                                                                                                                                          SHA1

                                                                                                                                          18b5536ac77231429ccfae8fb4e12fc2b184f32f

                                                                                                                                          SHA256

                                                                                                                                          740a7e143e6aaee8a73cc98ea7f8ca3d8d2bb40544c98485fa26949acb283e6a

                                                                                                                                          SHA512

                                                                                                                                          5fe91b5a428b6aa0da21ca8bf95661f8bcb921703b173c7bc7b05273cb56f6bf895afb09f26705bccb10e7c6cd0ae85e44939afc385efa8184c0a5cd273f0565

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTORE_F_COL.HXK
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          6a992d64b04142f8d67a040662d10e45

                                                                                                                                          SHA1

                                                                                                                                          363c824df805ae3b58afd3746a3305cbd7473329

                                                                                                                                          SHA256

                                                                                                                                          36e52b278b51b1b23d3530fc5f69d645b4399bde44f466101d8bc2bfb46aded2

                                                                                                                                          SHA512

                                                                                                                                          d2c3053b49f13cda57d40faa0f3fc742effbf74ec476be80ebc8d4bc6b9085592eb9cda78768122ac418dea8665a23ffeb4b6d1e41e6974e1b59fc3fd4c25470

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTORE_K_COL.HXK
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          896be533068f56bed17044fe016139f1

                                                                                                                                          SHA1

                                                                                                                                          d33dc08d965418f126ab88b8eddcc0c3b6495cb2

                                                                                                                                          SHA256

                                                                                                                                          2b204c08084645a29fc627d7639d142c588efa394b850e728a0def890976c5a1

                                                                                                                                          SHA512

                                                                                                                                          735bb19114c445c068e293599c6e08afc75b89a00c01df269c6024a46b4282c88a948811e557dabdd3d389baa9144b9b5f0dcf90b545330dc114e573d491b672

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_F_COL.HXK
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          9bead423b487cc6a7dd6eb1997fc2717

                                                                                                                                          SHA1

                                                                                                                                          87cf3b78bd2faeb2a555254ac22a1446f8da0fc6

                                                                                                                                          SHA256

                                                                                                                                          f70078c4da03444f198c212525f82c0068570812f30d731e22a29044596b033f

                                                                                                                                          SHA512

                                                                                                                                          17025c8da250e015b006ca479ade159209e2f551f1ff08dc035a923ede33dd404a0b5bc9c3c94c67611e5cbb3016ba88a0c6ecd0a2ef6bd0bc853228d0667ef1

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_K_COL.HXK
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          5a1e14d9111ccc6e3c791555926dd953

                                                                                                                                          SHA1

                                                                                                                                          2186f07b511aee763de7ebe2c4c5fe8b965bfd9e

                                                                                                                                          SHA256

                                                                                                                                          05d981d3ebbbb05bbd0b523ca7556d98b82a51b98b3c2807cee13a0ccda4c294

                                                                                                                                          SHA512

                                                                                                                                          0aa6fdbb7fdab90887208e872814f1093ae6a1d12dc79d524a77f2606278cf7f01f77e3595d1395b4f02523008adb6beb375a15d1c74b8db26c3222a556fa943

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL
                                                                                                                                          Filesize

                                                                                                                                          240KB

                                                                                                                                          MD5

                                                                                                                                          a43f572d01503d3aef99d314c271a094

                                                                                                                                          SHA1

                                                                                                                                          261c8c0cb2b5ec8b443ead1ecf50ee3ce68a72a6

                                                                                                                                          SHA256

                                                                                                                                          abaac16983062ae354805e689853ea6af1f560037d22c59fe47cb23906f5ee05

                                                                                                                                          SHA512

                                                                                                                                          7c5cd8ea22785eec80b6c58a809e8b8f2df01eae371a8b12534e276ce185d8d85024284e56f2ab6875bd57cf3ad39fcc84e475f94a374d5f8edab868591522a7

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\TAB_OFF.GIF.infected
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          56a720b96627cc0665a29a2468707d2d

                                                                                                                                          SHA1

                                                                                                                                          f6ce61bbe811059a115d80df56e997cad8a44038

                                                                                                                                          SHA256

                                                                                                                                          b2be36a2153d5c25849448b35b8274653e9d0c5cb6af73b9c651241faacfb78e

                                                                                                                                          SHA512

                                                                                                                                          8405ecf30780b11a019574c4a0c218a6639d35c58797d284693811f109753c8f1daa8e0b85ae3338c8cf0fc4fc95ea53998c1c09e28708917c2b7deaf5ca74bd

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\tab_on.gif
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          7f34c1ab691e6bf6b9b6ff6e6491b844

                                                                                                                                          SHA1

                                                                                                                                          ba38aba07006dc3e9ce0732716af2110a76976b7

                                                                                                                                          SHA256

                                                                                                                                          051ac43874a3e12f32776c6e03b99016a8da952d2ba5a0815c1d9d600a7cecff

                                                                                                                                          SHA512

                                                                                                                                          f969cabd2c2ae9c438085eca389e5592c3cd3f498e2da39b474136a908b9fa9ce434198e3a3ddaac870a472e7f1a718a700631b4aebceec2a257f2be4736d48f

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\BUTTON.GIF
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          99c483af8d122e48a8c1af1bdc8d1a6d

                                                                                                                                          SHA1

                                                                                                                                          9fa1cbc3c14b44233aab04612ad544d099debb4c

                                                                                                                                          SHA256

                                                                                                                                          7309ab997ea3c049f949f461f020ce2b0acf4c0fce1a68e181312ed132a2c8d9

                                                                                                                                          SHA512

                                                                                                                                          f68b6e78ca28848d878ef6e4768b2d5734018b1d42bcca57925f4ae8799421ec5e4cbbaaccd84dd763c1ed4a47eea9deff6ac7de177878e6e485a2d9fc36ca2e

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF
                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          21afe05e6c9c232269fe28cf3469be94

                                                                                                                                          SHA1

                                                                                                                                          7bd338410c7b9ad46be1283dfa7faeb85f6a2105

                                                                                                                                          SHA256

                                                                                                                                          dac6a17690ff60dd7c9623c8670004821368a63d2ed39d3ee2c357a2a8c715da

                                                                                                                                          SHA512

                                                                                                                                          66ef47182cbeadb77d927639e3b92208100f0b366ddf8cf78c44a938a78e9f37909cf71e9d430f2393b138dc85d61b81924f15681ed15486ac177d4ece9d54d8

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF
                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          5fac65d7f08a57c050b1bfda5d227483

                                                                                                                                          SHA1

                                                                                                                                          21d1c72961337874b5d54173f4019fd577f947ad

                                                                                                                                          SHA256

                                                                                                                                          c1797f3d02583dbbb8ded2f6815c5d9d8946f147f1e6ceeec00305cf450bdc9a

                                                                                                                                          SHA512

                                                                                                                                          7c2d50ebf4673fc18be40e5547e58ea1cce14d405212b04899b2d68f30e9a8805162e0ca98c7a5d934c8158e8fabbec0b9aaa3e5d847b5511a06df5cc4a548b0

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF
                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          7fbeef79934fb1ea9e504f10549ccf1d

                                                                                                                                          SHA1

                                                                                                                                          d1314d57d7891cd952b024b6fa16e4e3371d8d7b

                                                                                                                                          SHA256

                                                                                                                                          4115b166e97662f105c7444c7aef4b1772132ddf2a6ac403240abc48a3290c33

                                                                                                                                          SHA512

                                                                                                                                          95695ad86d128a31f45d1b1b2d952077db3a8db9bab69fe45d0dd1be50d6275adb260e5508c935c072ca2963c9b5d47e90fade7ff042296667a0105b79565fd9

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif
                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          029427e885662d6e660e800d31ba7251

                                                                                                                                          SHA1

                                                                                                                                          1be3698634a079f84d17a1b2f60e83353c57da99

                                                                                                                                          SHA256

                                                                                                                                          9ecedc95294ba8e5c49fd060d12a0d283cc411e2a9915e2797889a75f4b33947

                                                                                                                                          SHA512

                                                                                                                                          da120a8380e6564e93270b5a65afc01bdedd01c5a92147238905598510716849bd7d218cc630e76287a556c16169c0b19b7584c9dffdd1d8dc77c4a8da1e6037

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif
                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          6556dece2ba37c0946a895ffeaab2589

                                                                                                                                          SHA1

                                                                                                                                          cf9cdfaf7d79e3b021a56efab3b24c9f69fcb6c4

                                                                                                                                          SHA256

                                                                                                                                          1580481bb273a4f12d24a9e35f4ba04cc4578b359ff05921e58fc36f571e4383

                                                                                                                                          SHA512

                                                                                                                                          9ece50aaf613f5dca54c2bb17b1021f4003911c896e60c5022ec3483bee3c81fc27dc5d867c50feec3d811d21c8d1fa1928780040943756e25858c1d2941dc4d

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif
                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          f0f7ccdefa36bed29c6deffe05c332e5

                                                                                                                                          SHA1

                                                                                                                                          3baac09347c13920689dbbb6a35bf2d7d3ee5792

                                                                                                                                          SHA256

                                                                                                                                          56a742063617221293eb190b997ed69f79546729b8d1801e8086b4195560ce1f

                                                                                                                                          SHA512

                                                                                                                                          1dabd5b80b6f53b59b5b12b501cc7710c9cb61045b4a847f0542bcb1ae365fc6b8b21e857c36ea3b1a0f213c9715707951c7838bc50b40d5545e6575abf9189c

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif
                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          0116b4051d80600487f14e033b06d036

                                                                                                                                          SHA1

                                                                                                                                          5dd88ea81e1a1b736c1c451923cf404dee0ea944

                                                                                                                                          SHA256

                                                                                                                                          685449eab201f8768f35dc686b05987a88e9793354dff16f2ab2aa265ccde4dc

                                                                                                                                          SHA512

                                                                                                                                          f557c8c241af083f327b38e19fe0b2cdab5ed083685000939a09917c5ab445ce3bb9d68d90890ef2319115055305ade7af24f8ac1222102bf7710d7dd4b3e22a

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif
                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          5e8ce55f5c0f34c95f7d56b81361c580

                                                                                                                                          SHA1

                                                                                                                                          b78d718ecb5c1b2f137060c45a347587755f7da0

                                                                                                                                          SHA256

                                                                                                                                          0fe44633e696aded2c8913b9a46220d901106f26eeb29fe8daab457d336be28e

                                                                                                                                          SHA512

                                                                                                                                          0ec27c9a20b2dd578c0bdef5bda805027dd39b27366ddc0be7590531ae688a0cd79ba2aa408d6651e741f4423f86921a2916c941100b531f83e272dabf3bda09

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif
                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          9ad5fb630d8ed0c71b7499613e1caf3d

                                                                                                                                          SHA1

                                                                                                                                          6283516cb469ddb1f04eee90cd8226380c686d9b

                                                                                                                                          SHA256

                                                                                                                                          a62571f7cadea933db6e9842ac33881ae88da1e678a5a0dd548b1398bfaaa8b3

                                                                                                                                          SHA512

                                                                                                                                          a8c17982c3b8ef74cbe41f531545327c24e83eda8fdf7876ccfbf76b2de55b2ebc7d5ff60a5521e29de382d8e5202b0fb998bb50742c30df9a31bda05fecfa1d

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif
                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          99abca91244caf8233b32f902e5c322b

                                                                                                                                          SHA1

                                                                                                                                          cab2335fe0b189bef3b3ba614244c8d9d320f363

                                                                                                                                          SHA256

                                                                                                                                          ca2468b643af368385f918668fab390b5d0f1c4b231cc6093a212f4a56189702

                                                                                                                                          SHA512

                                                                                                                                          d52fd8d4e31830ae89c75466682b162b73ff89a3b89d5008c1c8572f94d86f8edf9ef84246b462361330eafc227541f3a91659a2d48a91ad9fcb17c7383d035d

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif
                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          5bd0377da2cfe8fda308288a7d322b3b

                                                                                                                                          SHA1

                                                                                                                                          9662e890c73bf3781a5023f57f38db8f7993db72

                                                                                                                                          SHA256

                                                                                                                                          079be119a990567dc56871c8aed461272b90f75fa1f46b3e043f8566d5a114cb

                                                                                                                                          SHA512

                                                                                                                                          185c10466d90c66bf1e67006804d3d9f0803b41d9434b479f9e461e256095e52428daa303080de592bc8489c0742940bfe95f7249009b4edd8d94898f2dcdada

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml
                                                                                                                                          Filesize

                                                                                                                                          248KB

                                                                                                                                          MD5

                                                                                                                                          14d2416669e3e533e67a5868818726e6

                                                                                                                                          SHA1

                                                                                                                                          722fc785b8a6c7cc330e1011eb8faae72c7d8a6f

                                                                                                                                          SHA256

                                                                                                                                          d2a1b2b52a1645c06f465cb77ae6e0503af75fb47cb0e9e219a95fd236a7a79f

                                                                                                                                          SHA512

                                                                                                                                          ae3e29912c90e7446e6fae7f51fab6f01c893da1aeab5c8a334f63e5971d3cf5eeea6dee6bd0be41f98c76a2e57d1f1eab710efe8b4ef8c27580d35e3bdd70c0

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML.infected
                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          bfa6f9ac725b9c832dd83b07095f7dc6

                                                                                                                                          SHA1

                                                                                                                                          0eeaadea68d47a534ed4d72ad2aa98c58c5d48ac

                                                                                                                                          SHA256

                                                                                                                                          7abdc75149007d5dbbbcae36b1cf82f1e8e0488e1316d68ba21542217119254e

                                                                                                                                          SHA512

                                                                                                                                          190be4d9590d4cc424060921e59fac4ce554788d1e4ebfad3eec941d332e19f5810872c880a5f746907b105a42e61a2cffb64f16245191897f97136e34783b52

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.NO.XML
                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          44acb414f2dd30f2d372a1ed0f0e59d5

                                                                                                                                          SHA1

                                                                                                                                          a82ea2495ca3357b98fb205570ae4690e682a77c

                                                                                                                                          SHA256

                                                                                                                                          f570a8e0976686f10143c995366c2de5a38e6929d54306d337a3d264340b0653

                                                                                                                                          SHA512

                                                                                                                                          792440b19c97a8970f24c6300279f84f615db1c8876bb5c93a494da3d0b5bb934d619981545ff6c50b503aa5d332f83d6fef1eba421d4c0369b5f7cc0f8f5ae2

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl
                                                                                                                                          Filesize

                                                                                                                                          7KB

                                                                                                                                          MD5

                                                                                                                                          c1c06e7ea206a95bd7cc4053549bce07

                                                                                                                                          SHA1

                                                                                                                                          b2efcfe17067e5fed856594f55cbaba15b989ff4

                                                                                                                                          SHA256

                                                                                                                                          a142cb412e4da5ac094992456dbe6684419d39e3f71444e9648098cef1361dcf

                                                                                                                                          SHA512

                                                                                                                                          d1c87bc7d25d3a9953c9edaea5e9f1bab2cecb9b341ee2fced4499f091650c6cba9bc4c2343a4d5cec99e0796b7ac40747adda25f529673a85a0fe267d747cac

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          78da61b5fdcccfdae668ed438582b3c4

                                                                                                                                          SHA1

                                                                                                                                          6feba6c3085129068885e4ecb69e8a5b64a7b09a

                                                                                                                                          SHA256

                                                                                                                                          f41e008ab8bcc8966245786288e3aa6f2b999d48ff1084d581645478e19ce6fc

                                                                                                                                          SHA512

                                                                                                                                          c4e2b76d0456656b296cbe378a8c3338b93ffa34d7d54f9c85d47de7781ceae323d8c22316323bd415fbf2a76f0dd8a5cfc1ed294fc02efe48388af173b15134

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          591f4c66afdb73880bac9efe4f9f4cac

                                                                                                                                          SHA1

                                                                                                                                          eb422a22fef50f5821846cbcf5ba2dff86533d5a

                                                                                                                                          SHA256

                                                                                                                                          829f6662e3581cd28e07b35ad95b29719b8cf82721099c30d4dd242c2e0c4833

                                                                                                                                          SHA512

                                                                                                                                          51d647ff5bfc45c46f1bae3086dcd202fb5dcfdf98ef20113f58a520ff8f9059f3f9290da2e270383c8a65e64243c661ce46efcd4b872440d873d4b1f7d1fc12

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          9b726cbfedab7421663f2190086fccd1

                                                                                                                                          SHA1

                                                                                                                                          5952d6be410ce5874946c74e0e27100af4c3651f

                                                                                                                                          SHA256

                                                                                                                                          f0817114f70794cc21b6cd3164b6b0a058fcca7ff7f413f2fa33fe3c835290b7

                                                                                                                                          SHA512

                                                                                                                                          93eb4cb79b01696f187068656e14cb58f1b11d56a28ff35720af41ae9b7222a58f86e2d5e502636d0e34b7679b252eb0818088cfa9872cdc98b7294a017761ab

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          8b7849e13888a14306af84b97ea69aa4

                                                                                                                                          SHA1

                                                                                                                                          c4866aa033f10bba3ce0110a0b34a314ed9c01b7

                                                                                                                                          SHA256

                                                                                                                                          84c09782c3ed56c8c461278878903da17c645cf59749ce515a0b22446f734cd3

                                                                                                                                          SHA512

                                                                                                                                          5b7e49b75157fc7de5d4ca8a70b185eb938e14721255b81f56c9574fde5b6e2f059d99381a0c8f3307079aded399fe202292064e39dc6cb220e4a6c0e5a96aa5

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          53cf87bd5b38269edc5a568962607c6e

                                                                                                                                          SHA1

                                                                                                                                          5ca0932bee25612719a0aa3696842839b0cd7a07

                                                                                                                                          SHA256

                                                                                                                                          e789566fb1c45c53d5cd7b956b39ec46515d8f92a9fee0dd48bc7d9a09a3e0f0

                                                                                                                                          SHA512

                                                                                                                                          2d7207344f8cfc40f1591d206b7c96ae3f41ebe313d381c4f3b957c252c1845965f749fb6db7b1c26cd1f23bfbec929897e5801ae5be213e03b00894d4860afa

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
                                                                                                                                          Filesize

                                                                                                                                          13KB

                                                                                                                                          MD5

                                                                                                                                          af3387415c00a4252a66fe521d008854

                                                                                                                                          SHA1

                                                                                                                                          72ffdb728ec111e161668c94c5d6c1e7f00d655a

                                                                                                                                          SHA256

                                                                                                                                          ab6f0286b3984ee5681a4e0d28a5efbbeb7cebb6212cb91802e4b1dae6bfce1c

                                                                                                                                          SHA512

                                                                                                                                          a2c2afb582492fe62ba88639ca0e0ee7229f8be22968246868c2764e825447b9372bb1e5c33c28bcb8ccc22b7af6ae26ec74b243069c46797d7d8db0d1ed8e6f

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
                                                                                                                                          Filesize

                                                                                                                                          10KB

                                                                                                                                          MD5

                                                                                                                                          949768128e4e9654bd6ea5f5fea39309

                                                                                                                                          SHA1

                                                                                                                                          a0b4ff185b36ce79204a98ed2e4a294380a172d2

                                                                                                                                          SHA256

                                                                                                                                          35a9e2766ae74cb6f5d2c3caa1bae0c3b3048c8406a9abcbab2c289ffca4d382

                                                                                                                                          SHA512

                                                                                                                                          c5e68ce25ad559787e24897dba466543010dc8e3bb6a7e6853ed937edcf0eac4f59b9838ee11f0a3ef6b3c4a43a9747cd1c0e5276641d54e4d7491165e27820d

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          92606a89e7721ce7ef016865f34c03e6

                                                                                                                                          SHA1

                                                                                                                                          aa5398d1fb49a66ce69847a7defd03dba265f963

                                                                                                                                          SHA256

                                                                                                                                          997446940ded5648e82c39143d571b21d9f9c6260046b76f7041ab8b1c00aef7

                                                                                                                                          SHA512

                                                                                                                                          92f6403c8b3bd87c389bd852967d44be15949fa8caf96cd797b55f658b0028dfa5a3b1206f9f2c68e8dea29eedd6e59eeb544f29b74b66e073efa90069edf8ad

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA
                                                                                                                                          Filesize

                                                                                                                                          9KB

                                                                                                                                          MD5

                                                                                                                                          37eb5eb50f8cac77cc9fc8c207d2b7b4

                                                                                                                                          SHA1

                                                                                                                                          56cce3cea024b5549c5608942dff0b51cddc64ac

                                                                                                                                          SHA256

                                                                                                                                          9dc5958900def33af57d2ac65be5df30728e09e177dd5c046b3f8786c34fc145

                                                                                                                                          SHA512

                                                                                                                                          f9a981a582bcd04c4f7ee95fb415394559268e38787ada80480c4e46b98cc543b7c182237423a821086721cfd4b1281cb1f0bb23bf3795d4f646b2586ce757c6

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
                                                                                                                                          Filesize

                                                                                                                                          12KB

                                                                                                                                          MD5

                                                                                                                                          24bb33b3b8ffa9789719a8dc584439e2

                                                                                                                                          SHA1

                                                                                                                                          09d9643928a287265601b77e4cc16528f7108020

                                                                                                                                          SHA256

                                                                                                                                          fd5210abdea0d4e07b2f7f524b6e3da66e6bad2848a559004d976c210e810fdf

                                                                                                                                          SHA512

                                                                                                                                          98291859841d7b37c0cc6b6f5a5e34430cec9bb20a6287b015b7e299e1300dc1418922dedc47829ea4c8e48e27e6dd53a1d10c049da3e8e73b940861578c2a50

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html.infected
                                                                                                                                          Filesize

                                                                                                                                          13KB

                                                                                                                                          MD5

                                                                                                                                          2bb567fbb5f51686c344eea6f8b6e585

                                                                                                                                          SHA1

                                                                                                                                          d31f81919f44f6798a3b0685387f7f27daa19133

                                                                                                                                          SHA256

                                                                                                                                          bae7daed0a314b003742fb1951bca82040f465eb06ee28253737698dc8eebb23

                                                                                                                                          SHA512

                                                                                                                                          455708a01030fa2cb8f3474d70c67e1edc52c4efcc3f5fa4c070b46258bedebe8d227ab4ee23322607293d1901f66a75bb30a900d348f12aa69d3d6d844ddf2b

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html
                                                                                                                                          Filesize

                                                                                                                                          10KB

                                                                                                                                          MD5

                                                                                                                                          94095610c67607f571761a1282e52582

                                                                                                                                          SHA1

                                                                                                                                          156b2914c2b26258e37d67967f18db2419abf555

                                                                                                                                          SHA256

                                                                                                                                          39d26cec174af43caced86441a6b099abe6935d87b24c8b202aa513941468ca0

                                                                                                                                          SHA512

                                                                                                                                          e4c839b2fbb8e83ff56014978d1d2474ebddeb8006eadfb0dae30b0efbe2acda3a93db90ccd16ee0a2a64d9f17557573bb162b3421fdea6e68adb8afa46177d6

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          347ad211b859431ae3f8db9d646e6b1f

                                                                                                                                          SHA1

                                                                                                                                          de483f33cffdaba49361ad558df9b1a9fa0aabb7

                                                                                                                                          SHA256

                                                                                                                                          c182dac873540ac4a62997c726a7230f1fc400619f341b834f3900559994c2df

                                                                                                                                          SHA512

                                                                                                                                          38dc27bd0641616f0bf9b7df91f4a61c454146d8f703bd77343efb6ddda27c0c24009e0d79898c83bc0b72e35abd492f3a3c7ec363e48ae3ee973b1d770390be

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          c1a6d642228a2fc793064bd38740f073

                                                                                                                                          SHA1

                                                                                                                                          239e56440598ecf56c63ed6c5197397fcb6996db

                                                                                                                                          SHA256

                                                                                                                                          632a13258f3e1f63eb1ba5f2a92d2aa470af1beef3b6c8b830eb28be352d4636

                                                                                                                                          SHA512

                                                                                                                                          f456ec13fffc90b447d776761a7ea5420a24714303fa63c0c49ab697e97425b4e029e30189f809e775637b17a4d2e4d7e660908360dfba9d406938ac363fb954

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\Java\jre7\lib\zi\Etc\UTC.infected
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          9ae1effe91f14b305f709fbce5bb3b51

                                                                                                                                          SHA1

                                                                                                                                          d315b987f0f9225f5c11e2ea86ff61dda1db97ea

                                                                                                                                          SHA256

                                                                                                                                          1904e39ad16ab5ae591f3f39bd41d86e6632e1f1d7309205ae7261bcf8d16db6

                                                                                                                                          SHA512

                                                                                                                                          a5a10af0c22e70b27c73479aff524a41a39e1d2adc3422c85c1d3a8256baff45b748915ce44e3f9b1e06c8545cc11614107d7ec393b6e663c9e111aedef306f7

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo.infected
                                                                                                                                          Filesize

                                                                                                                                          604KB

                                                                                                                                          MD5

                                                                                                                                          4334213852f2bd9f27fa29148a4e34cc

                                                                                                                                          SHA1

                                                                                                                                          9045a7265c78fd5aabe47e88359f19852e2ee2c8

                                                                                                                                          SHA256

                                                                                                                                          bce9cd5391e6d5732d3cd5e55ef3a3070afa2e4d2501ab100d073a4ec9a901db

                                                                                                                                          SHA512

                                                                                                                                          cc795580bd95af63c56f855e761d0570f80dcfc48cca981b798bb7d2849add685ffc0c88f7527c4a386c09083f444c30065270cd11566b011aad191d5ff1e717

                                                                                                                                          Download Submit

                                                                                                                                        • C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          d06f7f2fc348d6753f0db4b9f6da4ad3

                                                                                                                                          SHA1

                                                                                                                                          2c7e5918aca11647053b2f98f19e6cce854ae00b

                                                                                                                                          SHA256

                                                                                                                                          5dc3aa70eea67a7493aec4400916dcf89bed7033b4ee3b3d9fde53e009ad98a4

                                                                                                                                          SHA512

                                                                                                                                          277315efdf71ad659d58c56c58146328bfae667aa52d5dc34d477ca14b3cd45708d799cc172ed80bdf96c41ba3b0712b3f5b8526db06211ca19bb0284e58f31e

                                                                                                                                          Download Submit

                                                                                                                                        • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0001.000.infected
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          57a1056ac072c33ff3c9800c552dcaec

                                                                                                                                          SHA1

                                                                                                                                          37e411664d18490bfa50459a413cf13b9e4fd2da

                                                                                                                                          SHA256

                                                                                                                                          56817809dcc3bb2ffaba1a15d49d89cfd426770483b78e081587fdaffd8ce8b9

                                                                                                                                          SHA512

                                                                                                                                          323fb5175f1809c5f6636571e6d2576a5ecd9f66bcc63fffc94f8ff0c1464542c25393d1e7f4692417a91500e2eccbe294918da3120bdaa4bf1cc58a3e100e22

                                                                                                                                          Download Submit

                                                                                                                                        • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.001
                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          ad1c464325d87d232b47440f0103e643

                                                                                                                                          SHA1

                                                                                                                                          c49994a971d7b81ecd15e9e1aac733b0d4c7aebd

                                                                                                                                          SHA256

                                                                                                                                          a753be0aa7dbb947b72607a5a7e2dd8d68c15b187c0d7b3cbc8cb6a2f2070606

                                                                                                                                          SHA512

                                                                                                                                          bd63f49223af14911bb3cae66b74e30292bf395b5d1f6cd2fe6f9bcb9fc098d5e7b711d43acb70503516b6ca0f49746647080e25d0c4a04f7968de761979959f

                                                                                                                                          Download Submit

                                                                                                                                        • C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi
                                                                                                                                          Filesize

                                                                                                                                          181KB

                                                                                                                                          MD5

                                                                                                                                          50364f72f29eaf21c69d0f8fe8fd1dae

                                                                                                                                          SHA1

                                                                                                                                          8d4794ae363e8014624e96ca847b94ec39f646b9

                                                                                                                                          SHA256

                                                                                                                                          54fe65f6f6f9b0a9eb4060776c1bc97ff0aeabbc1ac9f9d432a30ba65121c06e

                                                                                                                                          SHA512

                                                                                                                                          bf63717dc124ecd5b3eee74abfe07aafd86d24fe35956ff41f423511b68acd9065718744b60ec812b5e3e2ef480462dcca0f580fbd31d3b9198d7eb2dd7475cd

                                                                                                                                          Download Submit

                                                                                                                                        • \Device\HarddiskVolume1\Boot\es-ES\HOW_TO_BACK_FILES.html
                                                                                                                                          Filesize

                                                                                                                                          3KB

                                                                                                                                          MD5

                                                                                                                                          a8514fd9f3a52ab2a00f57494d03b2fe

                                                                                                                                          SHA1

                                                                                                                                          0e204aabbd8b5d6ee1b36d10429d65eb436afd14

                                                                                                                                          SHA256

                                                                                                                                          056ae301d1686bbf2355fd96ef3363e2b18d593f58f912498d87de3569fa9028

                                                                                                                                          SHA512

                                                                                                                                          6250481712b51d19e13bf148e3cb046fbf669398b06f8ce757a8583a0fec36ca22140cb90d4706a731f27d1419795ff37ec079d170e15e9e2985020c1e6a1d5b

                                                                                                                                          Download Submit