51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IN.exe
Size

340KB
MD5

714870c33ba84e744b84b32e6e114ed9
SHA1

840f442d4466713becdf72b88846871330ac38e7
SHA256

51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51
SHA512

270c584cc9f696de3421429627a07bfbd7829a033cfdc16280e7e233e8ae09e2f1cd0341537a6b050811683d93a14a1465aa3ab96e9577c98ebea521faae65f2
SSDEEP

6144:PNs9prB0CnszdPZxMzk1ukSXa9bnuDOeFdGpBP7ENf3zcfUE:y9RaPZxMzk1uBXa9bu2JeAfUE

Score

10^/10

evasion persistence ransomware

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\da-DK\HOW_TO_BACK_FILES.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; word-break: break-all; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">{{IDENTIFIER}}</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

href="[email protected]

">[email protected]

href="[email protected]

">[email protected]

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3028 created 1236	3028	IN.exe	6

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1592	bcdedit.exe
2304	bcdedit.exe

Renames multiple (7547) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes System State backups 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1876	wbadmin.exe

Deletes system backups 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2676	wbadmin.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\IN.exe\""	IN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\IN.exe\""	IN.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	IN.exe
File opened (read-only)	\??\W:	IN.exe
File opened (read-only)	\??\F:	IN.exe
File opened (read-only)	\??\B:	IN.exe
File opened (read-only)	\??\G:	IN.exe
File opened (read-only)	\??\I:	IN.exe
File opened (read-only)	\??\K:	IN.exe
File opened (read-only)	\??\N:	IN.exe
File opened (read-only)	\??\P:	IN.exe
File opened (read-only)	\??\V:	IN.exe
File opened (read-only)	\??\Y:	IN.exe
File opened (read-only)	\??\H:	IN.exe
File opened (read-only)	\??\J:	IN.exe
File opened (read-only)	\??\L:	IN.exe
File opened (read-only)	\??\M:	IN.exe
File opened (read-only)	\??\U:	IN.exe
File opened (read-only)	\??\T:	IN.exe
File opened (read-only)	\??\X:	IN.exe
File opened (read-only)	\??\Z:	IN.exe
File opened (read-only)	\??\A:	IN.exe
File opened (read-only)	\??\E:	IN.exe
File opened (read-only)	\??\O:	IN.exe
File opened (read-only)	\??\R:	IN.exe
File opened (read-only)	\??\S:	IN.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browser\HOW_TO_BACK_FILES.html	IN.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\gadget.xml	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF	IN.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\HOW_TO_BACK_FILES.html	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341455.JPG	IN.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\gadget.xml	IN.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png	IN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107302.WMF	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200377.WMF	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01293_.WMF	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR50B.GIF	IN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\HOW_TO_BACK_FILES.html	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0232395.WMF	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21315_.GIF	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR9B.GIF	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\OFFISUPP.HTM	IN.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui	IN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties	IN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15060_.GIF	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\powerpnt.exe.manifest	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\STORYBB.DPV	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107526.WMF	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152884.WMF	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackground.jpg	IN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ckb\HOW_TO_BACK_FILES.html	IN.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\picturePuzzle.css	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck.css	IN.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv	IN.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	IN.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\RMNSQUE.INF	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01849_.WMF	IN.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\it-IT\mpvis.dll.mui	IN.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\HOW_TO_BACK_FILES.html	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\Synchronization.rll	IN.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\HOW_TO_BACK_FILES.html	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143750.GIF	IN.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png	IN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sitka	IN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\HOW_TO_BACK_FILES.html	IN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF	IN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar	IN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115840.GIF	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OLKIRMV.XML	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099190.JPG	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196354.WMF	IN.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat	IN.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png	IN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar	IN.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\8.png	IN.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\AFTRNOON.INF	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00449_.WMF	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18255_.WMF	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.JS	IN.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\calendar.js	IN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107502.WMF	IN.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\HOW_TO_BACK_FILES.html	IN.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui	IN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar	IN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\HOW_TO_BACK_FILES.html	IN.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	wbadmin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2688	vssadmin.exe

Kills process with taskkill 14 IoCs

evasion

pid	Process
1336	taskkill.exe
2984	taskkill.exe
584	taskkill.exe
596	taskkill.exe
2484	taskkill.exe
2812	taskkill.exe
892	taskkill.exe
1052	taskkill.exe
2508	taskkill.exe
2392	taskkill.exe
2792	taskkill.exe
2064	taskkill.exe
2924	taskkill.exe
2896	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe
3028	IN.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	taskkill.exe
Token: SeDebugPrivilege	2484	WMIC.exe
Token: SeDebugPrivilege	2984	taskkill.exe
Token: SeDebugPrivilege	584	taskkill.exe
Token: SeDebugPrivilege	596	taskkill.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	2792	taskkill.exe
Token: SeDebugPrivilege	1336	taskkill.exe
Token: SeDebugPrivilege	2812	taskkill.exe
Token: SeDebugPrivilege	892	taskkill.exe
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeDebugPrivilege	2064	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2484	WMIC.exe
Token: SeSecurityPrivilege	2484	WMIC.exe
Token: SeTakeOwnershipPrivilege	2484	WMIC.exe
Token: SeLoadDriverPrivilege	2484	WMIC.exe
Token: SeSystemProfilePrivilege	2484	WMIC.exe
Token: SeSystemtimePrivilege	2484	WMIC.exe
Token: SeProfSingleProcessPrivilege	2484	WMIC.exe
Token: SeIncBasePriorityPrivilege	2484	WMIC.exe
Token: SeCreatePagefilePrivilege	2484	WMIC.exe
Token: SeBackupPrivilege	2484	WMIC.exe
Token: SeRestorePrivilege	2484	WMIC.exe
Token: SeShutdownPrivilege	2484	WMIC.exe
Token: SeDebugPrivilege	2484	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2484	WMIC.exe
Token: SeRemoteShutdownPrivilege	2484	WMIC.exe
Token: SeUndockPrivilege	2484	WMIC.exe
Token: SeManageVolumePrivilege	2484	WMIC.exe
Token: 33	2484	WMIC.exe
Token: 34	2484	WMIC.exe
Token: 35	2484	WMIC.exe
Token: SeBackupPrivilege	1100	vssvc.exe
Token: SeRestorePrivilege	1100	vssvc.exe
Token: SeAuditPrivilege	1100	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2644	3028	IN.exe	29
PID 3028 wrote to memory of 2644	3028	IN.exe	29
PID 3028 wrote to memory of 2644	3028	IN.exe	29
PID 3028 wrote to memory of 2644	3028	IN.exe	29
PID 2644 wrote to memory of 2900	2644	cmd.exe	31
PID 2644 wrote to memory of 2900	2644	cmd.exe	31
PID 2644 wrote to memory of 2900	2644	cmd.exe	31
PID 2644 wrote to memory of 2900	2644	cmd.exe	31
PID 3028 wrote to memory of 2604	3028	IN.exe	32
PID 3028 wrote to memory of 2604	3028	IN.exe	32
PID 3028 wrote to memory of 2604	3028	IN.exe	32
PID 3028 wrote to memory of 2604	3028	IN.exe	32
PID 2604 wrote to memory of 2576	2604	cmd.exe	34
PID 2604 wrote to memory of 2576	2604	cmd.exe	34
PID 2604 wrote to memory of 2576	2604	cmd.exe	34
PID 2604 wrote to memory of 2576	2604	cmd.exe	34
PID 2576 wrote to memory of 2896	2576	cmd.exe	35
PID 2576 wrote to memory of 2896	2576	cmd.exe	35
PID 2576 wrote to memory of 2896	2576	cmd.exe	35
PID 3028 wrote to memory of 2856	3028	IN.exe	38
PID 3028 wrote to memory of 2856	3028	IN.exe	38
PID 3028 wrote to memory of 2856	3028	IN.exe	38
PID 3028 wrote to memory of 2856	3028	IN.exe	38
PID 2856 wrote to memory of 2616	2856	cmd.exe	39
PID 2856 wrote to memory of 2616	2856	cmd.exe	39
PID 2856 wrote to memory of 2616	2856	cmd.exe	39
PID 2856 wrote to memory of 2616	2856	cmd.exe	39
PID 2616 wrote to memory of 2508	2616	cmd.exe	40
PID 2616 wrote to memory of 2508	2616	cmd.exe	40
PID 2616 wrote to memory of 2508	2616	cmd.exe	40
PID 3028 wrote to memory of 2712	3028	IN.exe	43
PID 3028 wrote to memory of 2712	3028	IN.exe	43
PID 3028 wrote to memory of 2712	3028	IN.exe	43
PID 3028 wrote to memory of 2712	3028	IN.exe	43
PID 2712 wrote to memory of 2468	2712	cmd.exe	145
PID 2712 wrote to memory of 2468	2712	cmd.exe	145
PID 2712 wrote to memory of 2468	2712	cmd.exe	145
PID 2712 wrote to memory of 2468	2712	cmd.exe	145
PID 2468 wrote to memory of 2484	2468	conhost.exe	142
PID 2468 wrote to memory of 2484	2468	conhost.exe	142
PID 2468 wrote to memory of 2484	2468	conhost.exe	142
PID 3028 wrote to memory of 2620	3028	IN.exe	47
PID 3028 wrote to memory of 2620	3028	IN.exe	47
PID 3028 wrote to memory of 2620	3028	IN.exe	47
PID 3028 wrote to memory of 2620	3028	IN.exe	47
PID 2620 wrote to memory of 3016	2620	cmd.exe	46
PID 2620 wrote to memory of 3016	2620	cmd.exe	46
PID 2620 wrote to memory of 3016	2620	cmd.exe	46
PID 2620 wrote to memory of 3016	2620	cmd.exe	46
PID 3016 wrote to memory of 2984	3016	cmd.exe	48
PID 3016 wrote to memory of 2984	3016	cmd.exe	48
PID 3016 wrote to memory of 2984	3016	cmd.exe	48
PID 3028 wrote to memory of 2436	3028	IN.exe	49
PID 3028 wrote to memory of 2436	3028	IN.exe	49
PID 3028 wrote to memory of 2436	3028	IN.exe	49
PID 3028 wrote to memory of 2436	3028	IN.exe	49
PID 2436 wrote to memory of 2752	2436	cmd.exe	51
PID 2436 wrote to memory of 2752	2436	cmd.exe	51
PID 2436 wrote to memory of 2752	2436	cmd.exe	51
PID 2436 wrote to memory of 2752	2436	cmd.exe	51
PID 2752 wrote to memory of 584	2752	cmd.exe	50
PID 2752 wrote to memory of 584	2752	cmd.exe	50
PID 2752 wrote to memory of 584	2752	cmd.exe	50
PID 3028 wrote to memory of 976	3028	IN.exe	56

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	IN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	IN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	IN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	IN.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1236
- C:\Users\Admin\AppData\Local\Temp\IN.exe
  "C:\Users\Admin\AppData\Local\Temp\IN.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3028
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill \"SQL\"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c rem Kill \"SQL\"
      4⤵
      PID:2900
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2576
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlbrowser.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2896
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2616
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sql writer.exe
        5⤵
        Kills process with taskkill
        
        PID:2508
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2712
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2620
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2752
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
    3⤵
    PID:976
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
    3⤵
    PID:1484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
      4⤵
      PID:1292
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im fdlauncher.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
    3⤵
    PID:1324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
      4⤵
      PID:1620
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im Ssms.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
    3⤵
    PID:1940
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
    3⤵
    PID:1872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
      4⤵
      PID:2844
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
    3⤵
    PID:1276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
      4⤵
      PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
    3⤵
    PID:1684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
      4⤵
      PID:2912
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im msftesql.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1052
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
    3⤵
    PID:2908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
      4⤵
      PID:2352
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im pg_ctl.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe
    3⤵
    PID:1780
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe
      4⤵
      PID:2920
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -impostgres.exe
        5⤵
        Kills process with taskkill
        
        PID:2924
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
    3⤵
    PID:1704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
      4⤵
      PID:640
    - - C:\Windows\system32\net.exe
        
        net stop MSSQLServerADHelper100
        5⤵
        
        PID:1120
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQLServerADHelper100
        6⤵
        
        PID:992
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS
    3⤵
    PID:396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS
      4⤵
      PID:1124
    - - C:\Windows\system32\net.exe
        
        net stop MSSQL$ISARS
        5⤵
        
        PID:2152
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$ISARS
        6⤵
        
        PID:1460
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW
    3⤵
    PID:1132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW
      4⤵
      PID:1852
    - - C:\Windows\system32\net.exe
        
        net stop MSSQL$MSFW
        5⤵
        
        PID:1544
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$MSFW
        6⤵
        
        PID:2548
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS
    3⤵
    PID:2020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS
      4⤵
      PID:1364
    - - C:\Windows\system32\net.exe
        
        net stop SQLAgent$ISARS
        5⤵
        
        PID:1168
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLAgent$ISARS
        6⤵
        
        PID:1596
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW
    3⤵
    PID:984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW
      4⤵
      PID:1880
    - - C:\Windows\system32\net.exe
        
        net stop SQLAgent$MSFW
        5⤵
        
        PID:2000
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLAgent$MSFW
        6⤵
        
        PID:2044
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser
    3⤵
    PID:1968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser
      4⤵
      PID:1976
    - - C:\Windows\system32\net.exe
        
        net stop SQLBrowser
        5⤵
        
        PID:916
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLBrowser
        6⤵
        
        PID:660
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS
    3⤵
    PID:2876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS
      4⤵
      PID:1736
    - - C:\Windows\system32\net.exe
        
        net stop REportServer$ISARS
        5⤵
        
        PID:2420
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter
    3⤵
    PID:3024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLWriter
      4⤵
      PID:2188
    - - C:\Windows\system32\net.exe
        
        net stop SQLWriter
        5⤵
        
        PID:1980
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLWriter
        6⤵
        
        PID:3004
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:1812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:1804
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
    3⤵
    PID:568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
      4⤵
      PID:2168
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {default} recoverynabled No
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1592
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
    3⤵
    PID:1808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
      4⤵
      PID:1760
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic.exe SHADOWCOPY /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2484
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
    3⤵
    PID:2728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
      4⤵
      PID:1516
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
        5⤵
        Drops file in Windows directory
        
        PID:2160
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
    3⤵
    PID:2364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
      4⤵
      PID:2668
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    PID:2176
- C:\Users\Admin\AppData\Local\Temp\IN.exe
  \\?\C:\Users\Admin\AppData\Local\Temp\IN.exe -network
  2⤵
  - Adds Run key to start application
  - System policy modification
  PID:2880

C:\Windows\system32\cmd.exe
C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
1⤵
PID:2468
- C:\Windows\system32\taskkill.exe
  taskkill -f -im sqlserv.exe
  2⤵
  - Kills process with taskkill
  PID:2484

C:\Windows\system32\cmd.exe
C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\system32\taskkill.exe
  taskkill -f -im msmdsrv.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2984

C:\Windows\system32\taskkill.exe
taskkill -f -im MsDtsSrvr.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:584

C:\Windows\system32\cmd.exe
C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
1⤵
PID:1096
- C:\Windows\system32\taskkill.exe
  taskkill -f -im sqlceip.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:596

C:\Windows\system32\cmd.exe
C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
1⤵
PID:952
- C:\Windows\system32\taskkill.exe
  taskkill -f -im SQLAGENT.EXE
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1336

C:\Windows\system32\taskkill.exe
taskkill -f -im fdhost.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Windows\system32\taskkill.exe
taskkill -f -im ReportingServicesService.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Windows\system32\cmd.exe
C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
1⤵
PID:1520
- C:\Windows\system32\wbadmin.exe
  wbadmin delete backup -keepVersion:0 -quiet
  2⤵
  - Deletes system backups
  PID:2676

C:\Windows\system32\cmd.exe
C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
1⤵
PID:1228
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:2688

C:\Windows\system32\wbadmin.exe
wbadmin DELETE SYSTEMSTATEBACKUP
1⤵
- Deletes System State backups
PID:1876

C:\Windows\system32\bcdedit.exe
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Modifies boot configuration data using bcdedit
PID:2304

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "77387771-4986221071521687136-1174413471-8397377761414203941433412463-1592789621"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop REportServer$ISARS
1⤵
PID:1264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_F_COL.HXK

Filesize
1KB

MD5
2f8cdcf7aba39ccfca7fd64a819f85c1

SHA1
f98fcc7168e1260212698386b1148b3407b6f65a

SHA256
7a67bd858626c19851e5e9c954a7e3211a1b5a21850e67cd5b3dc7c1368194a5

SHA512
df77c643a9fd191e7b8d5f1575fbf4055d31777fcf09798098ebfbb4cfe2f0726dc1465a2029f3f1adcb9e57fd943ddd64a0de40a762302296ca0b3ec574aa41

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_K_COL.HXK

Filesize
1KB

MD5
0f5f98eebc8077028d268a2ca6df1199

SHA1
bd3f7af11181c26cf01f449aecf4d1bf2fe09264

SHA256
71d092c9e4db317bbb8c78ca8bc761938f56a651d1aab3e0d70f6521998febaa

SHA512
de6bd9e83c26681db00f45b3e80639a3516baf856cbceffb0f032f9b4307a36b1cead08213d2cefc793f47b5081da4c1b4ad02b89120cfa99ee26ca2df0db056

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF.infected

Filesize
1KB

MD5
33b4d48ba5ea66988a1b5c8c5755bcec

SHA1
a7997ff539a55b82dd4fac08ba9b28591fc0bf57

SHA256
b07efb919c402e07ed482a2612209bdd224ad129ee3e7654f2cfc8dddf4325e8

SHA512
0d0e696438ef452b984ec81accaf1c0b504de95a47738f529df21f127d60c453feb1b872634fa590fde04fa5698da2b8bd8da30544d74f429938613850b98a84

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\TAB_OFF.GIF.infected

Filesize
1KB

MD5
a948f034647d635465fa18b35b33751f

SHA1
e3f56c1537b8e138ff4a25a032d016287ac4a637

SHA256
89d42cd49f683d82e1f278d90cde5bae3ddc33ad5a40abcd65277c3e08d514c3

SHA512
a048f62174ad07cd843c5b94ff53acfa79e0955a61d17475eb8723886652122425f284e3ebfbced7ac5b27e5ce8e8a65c97a41c7ab5d930ed5ca75356f33cafa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_F_COL.HXK

Filesize
1KB

MD5
dd112c34ea7852acb71c538b9c60c5bf

SHA1
44edd61541075b35dc992068cc99e66453e7cb8a

SHA256
fae3f06a0f9545be83a804f09663b4290a22f3452b69864271649345b9628a74

SHA512
8ab7ef5422bfe234bc83a8dda8b3797ba44b18098d780c0586242616e42d7a002892848d4c77aa66cc1a43bc96c1520453496f5b19b86cd05469540c8b2fb48f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_K_COL.HXK

Filesize
1KB

MD5
cbf4795cb628f48dff57387baab90577

SHA1
257f20589fd15e779bfbe08724336b75c7bc0a7d

SHA256
f14ca6489c63ee7bfb4c86d5495393d61cce4de440bb9ab9d42aafa387b9f9a5

SHA512
043143f86d778ca6ef7c8e4f7f19b5fe89d639699558b0afcd4fa6cc234bf839de0491c887a93935927d9cd4594fbac5fd21ff04f73b8fa07720729f5ab44483

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL

Filesize
240KB

MD5
8d12b2d74338e6743ede9f5019c25136

SHA1
839f1c0e474c1e3bbc1466e7963be9e8559b7c8a

SHA256
5c5fdfed03da2c50d467735d128c05f11e1c8f76f40f92d620a139ddb6d2d7ad

SHA512
25f6f47542b8fc3fa05fa1a9a6a9508445b93605e98184434a6ec1918ee922f5cb83edd98aa35232c0cca90a9e7758f71369e14ae77ab3b48de028f55eca7a4f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
1KB

MD5
f701fc3a962fdb086df2703ed7a60d65

SHA1
e63af9979385b98cba61526d52689bb5ff6600c7

SHA256
17642714fdb261c47167ee90af0ebd7762826b05a6b2ad1d7c63284c4e92519f

SHA512
aae4975cb4ff5cea5e37cb2561374f8d14a9500c963c076117b212632cfa4c24d5d38bda15ba25bd6a8e8c7cd429a25281b1369a7325b2fbceb96956d51a5ee1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\TAB_ON.GIF

Filesize
1KB

MD5
9ab4091a99c802a0743d80a7bd371503

SHA1
b9d968931892802c5f76a72dc83328161ce5c80a

SHA256
ff1a437c4c2212ade9b5ccd57abb3957baf7fdd77c0549a69658fda97594f29d

SHA512
5cae3f1ce555f59ac877a369eceefea3fc8b373ea92c26a667e2156175dd1bce634fcfec9c7c2d2d7d9d7e51f29fc2676b7bd00b1453658df7fd238694531cfd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
1KB

MD5
5d5dd3d4422375b28f5f8cdd5981e6df

SHA1
3cbe4f0950e9d78afd8367bd6d93d43f0cff0f2a

SHA256
e58f45aabc6c199db728ebebfde4f1c37cc87c0b08532c4be5d45b79dc1f9e60

SHA512
9ee15474db9bae4be464c90004c743ab939d38ad96239d9d4691f3802fedcca29b92939468a2b7a83640abae64140a78f0b887f5f9326aa6230f465813bce547

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF

Filesize
2KB

MD5
f6450d724b1bedadb74492bb6eaf9511

SHA1
f4e45c1d6d2dcd0405d73a3284b8e5d4ce31a0c1

SHA256
47d949c97298537fbc4e7cd2314f33f48769da3d0436dc15683b2c3da0e4b93d

SHA512
b163ac7444d8cb71ac06401206f76d5f4d9276c39fb109fd9eefa5f20b29e5a6ab199edad18f7d2d25c142e1133e2d5bf683dad60bdd6492bca173273094142d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF

Filesize
2KB

MD5
3b685853d01b7a9b26d9d1515bde81ef

SHA1
a37ab0dbe344d96a67463daa32e20f8194dab2f9

SHA256
3e0f72b9de9a05d7a076dc8be13885f23e30e3ff97e9b4293eebbc2aa630eb2a

SHA512
a74dcdf66e79e56b66e70aa2488fe749f29c1b00c85afe1b5caef7d5714feabbe95cd3ade234e288e289d0d81c6b14c800904b247272b02846e49cd6550d2eaf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\Microsoft.Office.InfoPath.xml

Filesize
248KB

MD5
37f21b00f70ac4e640e635ec00b74072

SHA1
f66acb92b00bbb86042fb5e0b1ebbcdf362684fa

SHA256
c377168031e9e6988902b617203ab28eddf6c6f19a7417e812da764850fb56c7

SHA512
bcb6b22e8195c3212228d95501fa7f3c891c7a068df9dfed5a5c131026d079892577350187eddfc7c584f248f4760ca45f2ff1ff873f131eedfe618baa86238e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML

Filesize
2KB

MD5
8b80cae5aceabaf4c7cd48f6c94a8b2d

SHA1
1f1925797c3b3fade4f694f217e75c1e4dead980

SHA256
537bcb9645603c940b3ac7e8bd7f19c1085271089eea58b1bc97cb232bfce3a2

SHA512
1d22eca0dae2232879cc058197c67db43066a7b60b66b0501c3714eeaa16910569c3205474f15caedf408b71e935cb0994ab750f76665d3ddbc567279b64bcc6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.PL.XML

Filesize
2KB

MD5
73f9fefe6c7d71d3519f3c874a939040

SHA1
ea64e6fe49db254065ea4f8bf6129d6775bd3a2e

SHA256
9710596b9d78b2a3dd7c7a0c0865b07f97d39316468ef1953965e6b9c44644ad

SHA512
83a98a8e4167b0b6a46f968456c7840865cc0cc1323a23e7f39914e4cd9384c73f1d8a7cb6375c4db54e7d6119d143b8769ce994f666e29c75a19063ac2096dc

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl

Filesize
7KB

MD5
ae1684da3a0ab8c74013ca5472fa2012

SHA1
dc3ab9af8d1313917d34ebf4491b84e19bf8d033

SHA256
00e90f3df0950a1114ab5a059662853a3b3677a6089ef47d8cafa73959cf472c

SHA512
28e26c35f9ce2299e4601343a0a2eaec858d1859aebb0d4af74ffb4b22cedc4ca78572a6a17628960ac98f7d25ce92a6d8e8c5fda220f7c58ee9ba976a930819

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.infected

Filesize
1KB

MD5
12e80c5d787ce4a23de903024ffc1ad3

SHA1
98ca2b8bd7c0a3488d99ba68681d4b212c3b889c

SHA256
5b64cbbefa9d11cb142b8cdfe1c3e6f7edaca90c7611344328f2e65391fecf61

SHA512
753209a1f11200003945ad12cdb7b5d0dce6474eedb6489f83b3236339cf869002c4304b088bfaef2be6f738d519639e5ff374bd4637f5f4023ea3838dc92f1a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC

Filesize
1KB

MD5
2def321833c862cb06f4359c6f5a8fc3

SHA1
d07af6de8d1ce4c38882c8691652e7646b53d68e

SHA256
44fd99acf698454e362798aa4078b7a6f2f257348d40924c999c79c8cbc3d1d3

SHA512
2bd127753a64742ab8423269bbcd871c4e86397f376c9e060cff769db4a07fa8db6282d49ac368f4ef8ac3d7b0739251b8836da5920433b5bb79c6cc2ae8c604

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5

Filesize
1KB

MD5
34865bfa9a82583198d5413d5c7512bc

SHA1
ce73c8a26948497dfcf83ed28a5ae73922b098db

SHA256
0c7de15396a5156872571b00e7628fa9f7a498f3acb157e1724bbef7fa241cb4

SHA512
45e4a26781c0a0f84ff64a7e86e9cf5a9c42d8b6a66d64794bb660f18892ec824ce3720e546823861720cac2673f5e3e374823121c9e1bd0a89c982b3639a827

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10

Filesize
1KB

MD5
d97a7660b794a4395ca43c44c064abe5

SHA1
00e36bffc82dcbd34485577ad56b04145a65e347

SHA256
55a6f75a2daf5d86c919d99c0f0a62ee30517c915c7f66e5aae7f66c0d9c67aa

SHA512
35be1eb6164b436e75ae8aa80bc087cf96bb10211d2056cd28f4d78ceaaf70f742053037b72dc265c88c21ba0351208c641f1b76537e045a7fd2b6c8e5326487

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7

Filesize
1KB

MD5
cad6e82eb4c3cee7af06c4576b2c3227

SHA1
6f7c1aa7a7660c9a745c711332155e0985fde899

SHA256
1a3e23f55814054c1cc1fd690a391d3abdf8d70c7cc371a994a281757d5489da

SHA512
8b669bb587a4817aebb678db8d6c4218868487f6b452027cbc15fc94430dc8696f8c1a10887d1dbc9158ee274fc0ffde7800ff906278d42c24ba62fac79a0fbb

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
13KB

MD5
05b3ea3c8bacfcbdfab90c34f24c66ab

SHA1
32307cd59517a1f3d5213b8c6831bbbaee2c03a8

SHA256
452fdda59b424e148ab3789b30cd726df2ea721b0309b67ccf4d57b61d4b0884

SHA512
ff3099f88de0ffc133d7b072438ec25d45e7038f605c5432a0dbfadd22f7a31836034c61d91b7bd4f1c329b9321a0cd04ebcbe2bf0846561e632238502b6e6aa

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
10KB

MD5
c40596abaad92b3197485f5a39752eb1

SHA1
2a77426401c4884b47565a2acfc413101a4d5d3e

SHA256
719d9dfa0057ed42c1a4c8934ac6a49a82dcb49bebffb21df12a60a52e96c317

SHA512
64ec865664c1ef9e39ba7b54b291b293f33af7120ec826169f30e6311ca38f0d5440f648c7bc7fc25dfcacd5c5ca506375e0daac6768e166ef3240e96c908bc7

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf

Filesize
1KB

MD5
da3cc8ecf4e8738f5cde51a9c9ce3fbd

SHA1
b632f11d80b4791ccf11080a96477e8212af4d66

SHA256
d5f05a1e386cd306f5ab86a9eaea8693a3eacbd23de48f66be60bba8a7d471e0

SHA512
43e5a76809900487cceb0d43ca2f1f6b54389b14ec735def4911a52d60ca32eb81c5c7157493938620738b804c4422f5ce37d2b63daa9f25bd7e38f6cc907771

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA

Filesize
9KB

MD5
42d2f2e48e5addae9996df3fed9fc50e

SHA1
d4235946a1d3e786d5b8cdd6944980433c231977

SHA256
49a284481703cefedf1096f76c030e295ebb2a234aa67b8840a39fa3da53ad75

SHA512
ba3c4e34430b1b075d2e2fe3ad67bea24d390a9dd9d283437c20e6264d292774fabd113fdd5bc6425f4a0670c1e0cec0da4b8089d74157349c697c251e11d6ae

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
12KB

MD5
62e6ac8c3c20949a2eb7a2e8d35dbee0

SHA1
056dae7324df5826fea3b1d2585928cc96052729

SHA256
b7980af569c9497ae194632eece488d180aadfeee85204bc225cafd3076457cd

SHA512
1827010bf829c3ac56b5818cb1c89c6af75022eb5b00471cb0eea252506b8c9c73c4924c68a3e298aaee4ac6d15f1f4f7ec2da0f28b0547bc58714c8f6d702d7

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

Filesize
9KB

MD5
8fcea588e0b91c507b795353e4575b96

SHA1
ec52503991e82eb9d44fdbd49414b7f355255403

SHA256
4e642e74a5cea8f8d9a72a40a252d829b026d806e46c16f2a180c49784bb31ec

SHA512
dda86b3f4a54121e86d1aac8cec7a0624cef91e6b3aa4880840f6c0952def4ae8d70477d2242f0bc1316862dc3813b912079de885ecaabd55961200265fe7c50

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF

Filesize
1KB

MD5
d988af24e55e1967498249a19568bb9e

SHA1
1efc10c4b27f85e7f59eb3f2164955eecadd24f3

SHA256
eeca984c2d3a8439eddaebf4b86d87209dd7f9f10163911243f3c0187ed66b67

SHA512
c5f5db1642764cb7732c1a45c28530bcb9e19f49ad7f26b9dcf3020d2b6f4ef4ef17d389be6850ad5c89b956942909472e19e5ed836e78526e590cd131f618c4

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden

Filesize
1KB

MD5
fa77a722a44c7affe1fe51cc5c637c3b

SHA1
72d19f9370710c82d70e11adad1de9bb949e3927

SHA256
3b72f174cdee3ee5f6c18c4de011f9934c8efa12907075604af6c71baf7d00f3

SHA512
aa2da9794d003a08c94b279986e75a82d8d882b2fad31004b86cafdb805c55b48e7837f2c0301173b936bec1b77b8bea9f60ff94c583d5cfed42a788709a337d

Download Submit
C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif.infected

Filesize
1KB

MD5
ee5066d2219c89d8a59c4d6d9aa693a9

SHA1
b495e4b6b602183b88d43fc539c34b386c7a9323

SHA256
cdf583c6b91281d2b13f897e2c03c81adb6cee67d9403b5dafff6d4f4a84bc71

SHA512
f79e6ba1e0884d0bfa7e9faf5995864b52bbf14b1231a4b8ed7eae7b3d32e6e4e9426104517d368f1cbd7c21c4b974e18e66d514e53787068d6faa25f11966ce

Download Submit
C:\Program Files\Java\jre7\lib\zi\Etc\UTC.infected

Filesize
1KB

MD5
5c30ce4df7b312aec925904eba6a78b1

SHA1
637377933cb7f4df82841d81d822353598c9dcec

SHA256
5c489fec32494e0d246830da64cb6d65810a748bb20195a9c817ab9e09164210

SHA512
f038bdd5b97e9061e9f1758058bb3573e6485bcd31c78c86b1978db86c43f9c4a2adc23fa6cc0bf10ee3e9a833ee38c8e983b5e284f35977a61385d0d4f80d0f

Download Submit
C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo

Filesize
609KB

MD5
067a9bb9e30a27aa41817fbc0a711698

SHA1
c8f9a178cbfc55999148cd154253c12cd5cc34a1

SHA256
c625225f9a27e962423760c35275c2332f01052ed9844503daf69c73cc9a6202

SHA512
7621105f6cb12996584ec7770cab77ab363ecfcbc5c37d704ba1dfccf04fa56e82059232e505ce88413028321810b682d650813b992b45b1edcf9ac233237c7c

Download Submit
C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo

Filesize
606KB

MD5
ef28384cd0ed45e20a614c8bb466e487

SHA1
9aeb59898d71cffc3d9d7f4ee1ab4f773920ac25

SHA256
0d34132c9c508db74e3d0eac04fdacc5154dcb2072965d610535df77e891c83e

SHA512
1c08dd6fc2a7115de7d317846411159ae3d4e32478aa6e78e5703286a7bf7e08ded563ef98df4bde0d19187746b4fb3554f3a5aefad1c0b80c83232cd8026588

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck

Filesize
1KB

MD5
b8832e3ea05def65d4b40ead3056fe65

SHA1
a686c316e6fcab9b1b997b8ff0da483e772657d3

SHA256
004f3c8cf2cb35e75cef1664f0701176b8bc591835b79159ba7aca209a39b789

SHA512
610043a7ded0b2741382a39a550e726a5dd7679281a0bb6a2479cc91bc8a7eca6733569557d876f989f3052927807cb107b58527c1722169b451da624d10b17b

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.001

Filesize
1KB

MD5
aaa90f90fe41f8a633632e1899535f47

SHA1
e384f68194fa8be68b5920d0f9253c84d04ca314

SHA256
a522d22c529394ebf6d9d2433e53df264385a2e242f0de83933172e50fa6b030

SHA512
58d1a1cb5a05c06b723035660914a3ba4ba9e3c781cff27e465b01a467c0c2eefd03ffcd7f1ce4d23f107dcec133a8010fa366ae31d241f667e3f9d1999d8372

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAD0001.000

Filesize
1KB

MD5
ca4729861d53f531a1f928009f0a39b1

SHA1
f7cddd530ab3e6ebafaf7cd492abf91c43917d6d

SHA256
92cfd191c73a8e58378bc3f94b9fa4b0c372ce77b9c3c54ae6126005733347f9

SHA512
4941b812cc12656d3cfec93cc0bb0f134d3ec58daed298761f9e42ceb843f44542010c402bb13b0a69ba8882d2958acc5bc6d286ba443e8d359347e9af984ad5

Download Submit
C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

Filesize
181KB

MD5
982c15c10d641ddad93edec69dac4afc

SHA1
3f79023896935ba94db4ea57553f7b10886d3b99

SHA256
0cd0043b6650d1ceefd77fec0d5ded0997101b344304bce0adc377831485fbba

SHA512
bdd1c9fe85a56d5c7e471c0613b48856454e6e6bc262d536b868dfd0b7048c4fcd22f63bb588b9540077ceb4e9fa83ff1159041a0ca4b8064c83a35bdd5164c5

Download Submit
\Device\HarddiskVolume1\Boot\da-DK\HOW_TO_BACK_FILES.html

Filesize
3KB

MD5
a8514fd9f3a52ab2a00f57494d03b2fe

SHA1
0e204aabbd8b5d6ee1b36d10429d65eb436afd14

SHA256
056ae301d1686bbf2355fd96ef3363e2b18d593f58f912498d87de3569fa9028

SHA512
6250481712b51d19e13bf148e3cb046fbf669398b06f8ce757a8583a0fec36ca22140cb90d4706a731f27d1419795ff37ec079d170e15e9e2985020c1e6a1d5b

Download Submit