Overview

overview

10

Static

static

10

IN.exe

windows7-x64

10

IN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2023 14:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    IN.exe

  • Size

    340KB

  • MD5

    714870c33ba84e744b84b32e6e114ed9

  • SHA1

    840f442d4466713becdf72b88846871330ac38e7

  • SHA256

    51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51

  • SHA512

    270c584cc9f696de3421429627a07bfbd7829a033cfdc16280e7e233e8ae09e2f1cd0341537a6b050811683d93a14a1465aa3ab96e9577c98ebea521faae65f2

  • SSDEEP

    6144:PNs9prB0CnszdPZxMzk1ukSXa9bnuDOeFdGpBP7ENf3zcfUE:y9RaPZxMzk1uBXa9bu2JeAfUE

Score
10/10
evasionpersistenceransomware

Malware Config

Extracted

Path

C:\odt\HOW_TO_BACK_FILES.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; word-break: break-all; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">{{IDENTIFIER}}</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (4313) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes System State backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes system backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 14 IoCs
    evasion
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\IN.exe
    "C:\Users\Admin\AppData\Local\Temp\IN.exe"
    1⤵
    • Suspicious use of NtCreateUserProcessOtherParentProcess
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2736
    • C:\Windows\SysWOW64\cmd.exe
      \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill \"SQL\"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:416
      • C:\Windows\system32\cmd.exe
        C:\Windows\sysnative\cmd.exe /c rem Kill \"SQL\"
        3⤵
          PID:4044
      • C:\Windows\SysWOW64\cmd.exe
        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4268
        • C:\Windows\system32\cmd.exe
          C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:228
          • C:\Windows\system32\taskkill.exe
            taskkill -f -im sqlbrowser.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1412
      • C:\Windows\SysWOW64\cmd.exe
        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3400
        • C:\Windows\system32\cmd.exe
          C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3628
          • C:\Windows\system32\taskkill.exe
            taskkill -f -im sql writer.exe
            4⤵
            • Kills process with taskkill
            PID:4020
      • C:\Windows\SysWOW64\cmd.exe
        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:548
        • C:\Windows\system32\cmd.exe
          C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4520
          • C:\Windows\system32\taskkill.exe
            taskkill -f -im sqlserv.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:904
      • C:\Windows\SysWOW64\cmd.exe
        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2124
        • C:\Windows\system32\cmd.exe
          C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4580
          • C:\Windows\system32\taskkill.exe
            taskkill -f -im msmdsrv.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2168
      • C:\Windows\SysWOW64\cmd.exe
        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4120
        • C:\Windows\system32\cmd.exe
          C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4728
          • C:\Windows\system32\taskkill.exe
            taskkill -f -im MsDtsSrvr.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2660
      • C:\Windows\SysWOW64\cmd.exe
        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4712
        • C:\Windows\system32\cmd.exe
          C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3776
          • C:\Windows\system32\taskkill.exe
            taskkill -f -im sqlceip.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3676
      • C:\Windows\SysWOW64\cmd.exe
        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3336
        • C:\Windows\system32\cmd.exe
          C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5048
          • C:\Windows\system32\taskkill.exe
            taskkill -f -im fdlauncher.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3024
      • C:\Windows\SysWOW64\cmd.exe
        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4264
        • C:\Windows\system32\cmd.exe
          C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4764
          • C:\Windows\system32\taskkill.exe
            taskkill -f -im Ssms.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3148
      • C:\Windows\SysWOW64\cmd.exe
        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
        2⤵
          PID:3636
          • C:\Windows\system32\cmd.exe
            C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
            3⤵
              PID:4516
              • C:\Windows\system32\taskkill.exe
                taskkill -f -im SQLAGENT.EXE
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2816
          • C:\Windows\SysWOW64\cmd.exe
            \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
            2⤵
              PID:4968
              • C:\Windows\system32\cmd.exe
                C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
                3⤵
                  PID:2408
                  • C:\Windows\system32\taskkill.exe
                    taskkill -f -im fdhost.exe
                    4⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4784
              • C:\Windows\SysWOW64\cmd.exe
                \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
                2⤵
                  PID:1144
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
                    3⤵
                      PID:632
                      • C:\Windows\system32\taskkill.exe
                        taskkill -f -im ReportingServicesService.exe
                        4⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4376
                  • C:\Windows\SysWOW64\cmd.exe
                    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
                    2⤵
                      PID:228
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
                        3⤵
                          PID:2192
                          • C:\Windows\system32\taskkill.exe
                            taskkill -f -im msftesql.exe
                            4⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2812
                      • C:\Windows\SysWOW64\cmd.exe
                        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
                        2⤵
                          PID:2276
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
                            3⤵
                              PID:5072
                              • C:\Windows\system32\taskkill.exe
                                taskkill -f -im pg_ctl.exe
                                4⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4156
                          • C:\Windows\SysWOW64\cmd.exe
                            \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe
                            2⤵
                              PID:3508
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe
                                3⤵
                                  PID:4000
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill -f -impostgres.exe
                                    4⤵
                                    • Kills process with taskkill
                                    PID:1176
                              • C:\Windows\SysWOW64\cmd.exe
                                \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
                                2⤵
                                  PID:2124
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
                                    3⤵
                                      PID:2160
                                      • C:\Windows\system32\net.exe
                                        net stop MSSQLServerADHelper100
                                        4⤵
                                          PID:1268
                                          • C:\Windows\system32\net1.exe
                                            C:\Windows\system32\net1 stop MSSQLServerADHelper100
                                            5⤵
                                              PID:1068
                                      • C:\Windows\SysWOW64\cmd.exe
                                        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS
                                        2⤵
                                          PID:2660
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS
                                            3⤵
                                              PID:3280
                                              • C:\Windows\system32\net.exe
                                                net stop MSSQL$ISARS
                                                4⤵
                                                  PID:1916
                                                  • C:\Windows\system32\net1.exe
                                                    C:\Windows\system32\net1 stop MSSQL$ISARS
                                                    5⤵
                                                      PID:1048
                                              • C:\Windows\SysWOW64\cmd.exe
                                                \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW
                                                2⤵
                                                  PID:3776
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW
                                                    3⤵
                                                      PID:4140
                                                      • C:\Windows\system32\net.exe
                                                        net stop MSSQL$MSFW
                                                        4⤵
                                                          PID:4228
                                                          • C:\Windows\system32\net1.exe
                                                            C:\Windows\system32\net1 stop MSSQL$MSFW
                                                            5⤵
                                                              PID:1132
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS
                                                        2⤵
                                                          PID:4980
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS
                                                            3⤵
                                                              PID:3696
                                                              • C:\Windows\system32\net.exe
                                                                net stop SQLAgent$ISARS
                                                                4⤵
                                                                  PID:1596
                                                                  • C:\Windows\system32\net1.exe
                                                                    C:\Windows\system32\net1 stop SQLAgent$ISARS
                                                                    5⤵
                                                                      PID:3616
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW
                                                                2⤵
                                                                  PID:2216
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW
                                                                    3⤵
                                                                      PID:3024
                                                                      • C:\Windows\system32\net.exe
                                                                        net stop SQLAgent$MSFW
                                                                        4⤵
                                                                          PID:2872
                                                                          • C:\Windows\system32\net1.exe
                                                                            C:\Windows\system32\net1 stop SQLAgent$MSFW
                                                                            5⤵
                                                                              PID:1644
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser
                                                                        2⤵
                                                                          PID:3536
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser
                                                                            3⤵
                                                                              PID:3352
                                                                              • C:\Windows\system32\net.exe
                                                                                net stop SQLBrowser
                                                                                4⤵
                                                                                  PID:3728
                                                                                  • C:\Windows\system32\net1.exe
                                                                                    C:\Windows\system32\net1 stop SQLBrowser
                                                                                    5⤵
                                                                                      PID:3120
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS
                                                                                2⤵
                                                                                  PID:3900
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS
                                                                                    3⤵
                                                                                      PID:2008
                                                                                      • C:\Windows\system32\net.exe
                                                                                        net stop REportServer$ISARS
                                                                                        4⤵
                                                                                          PID:656
                                                                                          • C:\Windows\system32\net1.exe
                                                                                            C:\Windows\system32\net1 stop REportServer$ISARS
                                                                                            5⤵
                                                                                              PID:1864
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter
                                                                                        2⤵
                                                                                          PID:4964
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\sysnative\cmd.exe /c net stop SQLWriter
                                                                                            3⤵
                                                                                              PID:2128
                                                                                              • C:\Windows\system32\net.exe
                                                                                                net stop SQLWriter
                                                                                                4⤵
                                                                                                  PID:1580
                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                    C:\Windows\system32\net1 stop SQLWriter
                                                                                                    5⤵
                                                                                                      PID:3348
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
                                                                                                2⤵
                                                                                                  PID:4012
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
                                                                                                    3⤵
                                                                                                      PID:1276
                                                                                                      • C:\Windows\system32\vssadmin.exe
                                                                                                        vssadmin.exe Delete Shadows /All /Quiet
                                                                                                        4⤵
                                                                                                        • Interacts with shadow copies
                                                                                                        PID:4728
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
                                                                                                    2⤵
                                                                                                      PID:5000
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
                                                                                                        3⤵
                                                                                                          PID:5004
                                                                                                          • C:\Windows\system32\wbadmin.exe
                                                                                                            wbadmin delete backup -keepVersion:0 -quiet
                                                                                                            4⤵
                                                                                                            • Deletes system backups
                                                                                                            PID:4240
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
                                                                                                        2⤵
                                                                                                          PID:2100
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
                                                                                                            3⤵
                                                                                                              PID:4100
                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                wmic.exe SHADOWCOPY /nointeractive
                                                                                                                4⤵
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:3804
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
                                                                                                            2⤵
                                                                                                              PID:4768
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
                                                                                                                3⤵
                                                                                                                  PID:4484
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                                                                                2⤵
                                                                                                                  PID:676
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                                                                                    3⤵
                                                                                                                      PID:4772
                                                                                                                      • C:\Windows\system32\bcdedit.exe
                                                                                                                        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                                                                                        4⤵
                                                                                                                        • Modifies boot configuration data using bcdedit
                                                                                                                        PID:3912
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
                                                                                                                    2⤵
                                                                                                                      PID:4128
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
                                                                                                                        3⤵
                                                                                                                          PID:4580
                                                                                                                          • C:\Windows\system32\wbadmin.exe
                                                                                                                            wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
                                                                                                                            4⤵
                                                                                                                              PID:2124
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
                                                                                                                          2⤵
                                                                                                                            PID:2208
                                                                                                                        • C:\Windows\Explorer.EXE
                                                                                                                          C:\Windows\Explorer.EXE
                                                                                                                          1⤵
                                                                                                                            PID:3168
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IN.exe
                                                                                                                              \\?\C:\Users\Admin\AppData\Local\Temp\IN.exe -network
                                                                                                                              2⤵
                                                                                                                              • Adds Run key to start application
                                                                                                                              • System policy modification
                                                                                                                              PID:5092
                                                                                                                          • C:\Windows\system32\bcdedit.exe
                                                                                                                            bcdedit.exe /set {default} recoverynabled No
                                                                                                                            1⤵
                                                                                                                            • Modifies boot configuration data using bcdedit
                                                                                                                            PID:228
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
                                                                                                                            1⤵
                                                                                                                              PID:4508
                                                                                                                              • C:\Windows\system32\wbadmin.exe
                                                                                                                                wbadmin DELETE SYSTEMSTATEBACKUP
                                                                                                                                2⤵
                                                                                                                                • Deletes System State backups
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:3508
                                                                                                                            • C:\Windows\system32\vssvc.exe
                                                                                                                              C:\Windows\system32\vssvc.exe
                                                                                                                              1⤵
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:4136
                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                              C:\Windows\System32\svchost.exe -k swprv
                                                                                                                              1⤵
                                                                                                                                PID:3024

                                                                                                                              Network

                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                              Replay Monitor

                                                                                                                              Loading Replay Monitor...

                                                                                                                              Downloads

                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\db\bin\NetworkServerControl
                                                                                                                                Filesize

                                                                                                                                7KB

                                                                                                                                MD5

                                                                                                                                517030622648cca2fd2a7ee260d0d40e

                                                                                                                                SHA1

                                                                                                                                62b4edcc1128caccfa5fd2f09342a14d8a749f80

                                                                                                                                SHA256

                                                                                                                                7c772a647ab695a20acfa19cca200864747c12893220fdf2d16efa885f84cf44

                                                                                                                                SHA512

                                                                                                                                b43e7caeaf428397b7428ca597ecb004fc35fd117d7a8714f9483e3f96ef58afeb7c193a65b5644ce531ac00b39843efac3b2840f0b31d9b244c29ed34c239cc

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                fde084dd5c0bd9a1bc800ab9367360c2

                                                                                                                                SHA1

                                                                                                                                3daeef0e1d266783c2ea8c33080bf5d6c2b41636

                                                                                                                                SHA256

                                                                                                                                79bb4e4d2a6bd2e7a90c4af2f202a608b75d1e6b3423f33bed08662e6f22d58d

                                                                                                                                SHA512

                                                                                                                                1a4e7c37d219a1de88c6378fc4f6f71751295d07011da378e6686b3c43a2df90a76dc2e7bd84057182398eb995b1036c5127761fa416b0b319ebe8e10d45353d

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
                                                                                                                                Filesize

                                                                                                                                13KB

                                                                                                                                MD5

                                                                                                                                45e488eba92dd426856823d8435af54a

                                                                                                                                SHA1

                                                                                                                                6f038f31ea2eb3ae435495941b68a804a1cd3717

                                                                                                                                SHA256

                                                                                                                                a5eb3140b0cd4475d0a4093a65500cee957287352db0cfc5c47cbbaf0bc51b7c

                                                                                                                                SHA512

                                                                                                                                c7fc0ba3bc151e987fc1ea7f4c2d06617f9798663abedcaa7ac7e72a18a435ded960b2dde477e85913cc49a1af3accd801b52a7c32c8c1e2b7290cfc2dc005ae

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
                                                                                                                                Filesize

                                                                                                                                10KB

                                                                                                                                MD5

                                                                                                                                54cdf6995522b0271700e9063e4417af

                                                                                                                                SHA1

                                                                                                                                a19b04acc2b9331a72f3652606a2cb7889e205a7

                                                                                                                                SHA256

                                                                                                                                ad7be7aced6ddc0e3973500a76a18b7d48e2b617d33895057fbb84a3cef90159

                                                                                                                                SHA512

                                                                                                                                22e96d5a9b02396c507309af2713742418c03f0a86eeb2f47a7e1c6e164af2f90e301a9a7a8c5528068417fa5b0b283af8a56e7c72985323615657b7a2a2dc35

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                50fd416e4e7291c24d143633f3c3c40a

                                                                                                                                SHA1

                                                                                                                                d8f6dcea6de3d2b76fbbc748b778f4a46436612e

                                                                                                                                SHA256

                                                                                                                                5b58931fc6ce551cefac2bc45c2144cd1364ff85b945420266b41e34b26b3546

                                                                                                                                SHA512

                                                                                                                                225f19260c74107e699f4394a93b774765f6b71044233fb9f07e56c82d6df4ff2783c16d4db733c2f195effe7a2f02029d50e1e1694fae08951fe3e62dde1f0f

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA
                                                                                                                                Filesize

                                                                                                                                9KB

                                                                                                                                MD5

                                                                                                                                4f66772b904a6ba84215de0942b101f1

                                                                                                                                SHA1

                                                                                                                                f5ee56182f628c07771e7989144e8b975bf7ae8b

                                                                                                                                SHA256

                                                                                                                                0c5e848626a026d3eaae9a77dafb4105a8f26bac24b555875ffe9772d8a4ab44

                                                                                                                                SHA512

                                                                                                                                3c6f3476c85af7d2f9673abdbfd82aca207582096c800086f6781436908ce18eb42cb95df52c024fa0bb779184da34d7175158b3197f85aec18077ec582babb8

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
                                                                                                                                Filesize

                                                                                                                                12KB

                                                                                                                                MD5

                                                                                                                                ad6d95a9a1f0e0f0c4f5b9bdd9b59994

                                                                                                                                SHA1

                                                                                                                                decd3f92b258c9c35b54fba1481caed99aa3cb66

                                                                                                                                SHA256

                                                                                                                                4f8174fe747faaf4d129210aedaf66dcdba8941b8d171ffdab89c3cf4c6bc60c

                                                                                                                                SHA512

                                                                                                                                2fbdb8aa72c6d9923eeceb9cc92dfe3a7fe93fb4dd7552a0db27f39baa435b8ba7b5cd30986eb113a7caac8c890a2e087e2813ad2aedfd1adf6df6e3100396f6

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA
                                                                                                                                Filesize

                                                                                                                                9KB

                                                                                                                                MD5

                                                                                                                                2766d9dccb5f77a06e269712792a5f2f

                                                                                                                                SHA1

                                                                                                                                cc6dfd2bc86049dacd6a4a45e354fe003b0e7e23

                                                                                                                                SHA256

                                                                                                                                cac7b85c6ffbc161f2972f83115b11c6151bd6c2e61280e50f8963e25c90fa64

                                                                                                                                SHA512

                                                                                                                                3813dcacb506e1c3a88ec7aa4bfdace337b60d5e9f2bcbf94a2cce063f311c8af18adb5e75727698a671961bf51631685e2f1aeb735df7f0fd46590fb68fea51

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                0eebed49243dc27eb75137a417d2484c

                                                                                                                                SHA1

                                                                                                                                0113e3a62a27a4964ccddf2921fc23c379572939

                                                                                                                                SHA256

                                                                                                                                cdd4e73d34bfcb74e42c12cd1bb371e8a0cb0d4b553e0760866b8fb87f09c541

                                                                                                                                SHA512

                                                                                                                                bc9fc0b3cb4c82fb69391992612749c26e4c61b65e9afd0f21cf1c2911e6c844d59e849c07ae8e0cf14c1d547259f0c3ab1563bc0a474f86b4cd50aff43cbafb

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.infected
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                b628d8af9c008f0ec238d0dc3ff630fa

                                                                                                                                SHA1

                                                                                                                                512dac35f545289fb62e4563f728fed96ef6ac31

                                                                                                                                SHA256

                                                                                                                                7e604bb2b447f63b75071fc1bc9942497ce93011385790aae58726763cdbbc7a

                                                                                                                                SHA512

                                                                                                                                fb34b4e0462e7d646499535241d613fb08b967924c8c35b50cb18987b4bb1e9495fc1e2881d1056a73375e1f5b0ee0e08ae77345a8b28c1010a8322e0499497f

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\win32_LinkNoDrop32x32.gif.infected
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                5b16d5f87b5b868d6d8c4317564ab585

                                                                                                                                SHA1

                                                                                                                                fa807a427d930c17e4636085a5f838196a7974ef

                                                                                                                                SHA256

                                                                                                                                bc6b89272e84719fcc8a9a70b1d31bf9d21b55efbaad8f5e4238a6257d6cc51c

                                                                                                                                SHA512

                                                                                                                                fdcf386ed06d706ef66005df30bbaa3cb77d0d8c2ce9c75c46fc54c8efaccec4ff95beeb42e03b119c72a23775919b97deb2009c6d0d17d5ee6a087a4e6e5c16

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                97588854b5b566123a910628f55d38e8

                                                                                                                                SHA1

                                                                                                                                b360dbb6980e3fbe0171ff96c8fa59cd1a9abca9

                                                                                                                                SHA256

                                                                                                                                316b7fcdbe4c3b6a733d2917c16813da633671465b8f279d19dae7494ef1fdad

                                                                                                                                SHA512

                                                                                                                                58f60db4e22a320a5d398db369a1de1cc2eedc1ca1b8e6b664c8aa4e6ce304d9f58eaa6ab0c1ac5211980810466bb8b4f33ddd27e6d2eed04dda6042bfe688b5

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                4cee9dda64b76e8198011adc9bcae31e

                                                                                                                                SHA1

                                                                                                                                ee06aee0b681a13fb323d720b85975b40e307b99

                                                                                                                                SHA256

                                                                                                                                b3e19846cdf7c9b11e874b72b0d8fed77e58a4dad7a56168aea8103bb6fc2522

                                                                                                                                SHA512

                                                                                                                                120108ccc1315340848f8b92854d3a180182bf0246a930844f824ea959e5843ff8c9c2041b7e2a21eed56d636227a41a78a5efc05076349419a22c644d257fb9

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                5f37d74a5b4de217526aa2324738091e

                                                                                                                                SHA1

                                                                                                                                328c1a943b761727615f1a9021b53b7381ef3c49

                                                                                                                                SHA256

                                                                                                                                3c569eed99144a905a15d68f11f522788a05a0dbaeb285656c525121ca24e40e

                                                                                                                                SHA512

                                                                                                                                bab06177e70f741e118506a912a6c18fce2fbf985a9eec425d74b8a1ca62408f61ebbca973b6e62155016fb24bde6792796501359de2992567ef79facd545a3b

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                07c1c76e039f541dfa684214fdcad36a

                                                                                                                                SHA1

                                                                                                                                1f8a0a56196ac5d03fecabe840ec45dcf993d17c

                                                                                                                                SHA256

                                                                                                                                62b67a274f2cc9e4bf492e3e7896675c882506205f3ee82138ca76541d7e019e

                                                                                                                                SHA512

                                                                                                                                9d1a385d915d7a1edbd2873914986d20e5cce1febade9461687bf615a82d2e352107e22085abd3d146fc760b6f35dcec3180d48f1acf2f6c57d5b77295d394a5

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                2ee850eadf9f86968e844b51a27bc77b

                                                                                                                                SHA1

                                                                                                                                a3e4b052a10997e91e4d2052431b0f0c6ece7750

                                                                                                                                SHA256

                                                                                                                                b435fe30e717675ae27549660257dc71dc3239feee200fe15b2a40622294cdcf

                                                                                                                                SHA512

                                                                                                                                070fa8590096ce046b5ec809f3c16523c0b528ef40a8a364c4dec5d04a6973b2879eafb63bc35852255893cca770cee1529c26729daab4b0e7139cbf8e4c6248

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                02490ed77c703a220dc4b2b896b5f851

                                                                                                                                SHA1

                                                                                                                                a3b17b0eb2f82f46434140a080231fede5751866

                                                                                                                                SHA256

                                                                                                                                faccdee32017afb7e3413aaaca6fc33f74314493b9b3a67330a174091be2c7a1

                                                                                                                                SHA512

                                                                                                                                e834c993ad6771f9e0a5fa1b40a608afec642361daeca3693f9d9d5a03719430db53d037ccfbdfbbe3c91dc2b96074e7cac448db7c10e4e7d2af42014c16bb54

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL
                                                                                                                                Filesize

                                                                                                                                265KB

                                                                                                                                MD5

                                                                                                                                c30647ddc155959b172c7f7032bed48c

                                                                                                                                SHA1

                                                                                                                                d5626d6126327605d06cb5f3f8be84be51b73de4

                                                                                                                                SHA256

                                                                                                                                60109f5d74fb328d868e4860e3bb6216563215098baabe89854c0222e0cd18c6

                                                                                                                                SHA512

                                                                                                                                cd14eb1343bdb96a146b86bd006991366bd074e79fdd1e32cd2c343b8e6dafefdb016e3357f277b086371046684db60770640eb883ee1b717fb640465c358706

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub
                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                e91eb6e85baae6e6ca6dbe99849d3738

                                                                                                                                SHA1

                                                                                                                                3c38093bcd630ed706ae4ed8b70772e9d5dbeef1

                                                                                                                                SHA256

                                                                                                                                c403b062888a6ac79c4cb424cfd8624656b2c8635aac9d7cfacbcb75b69b6e8c

                                                                                                                                SHA512

                                                                                                                                ca2336efc92c49382b98f0efefe52e5368c0533876ad6e67bd15a20de6c695f1cdbc60d5e58765cad7252ce22377e88a850fa9e5304741ad038842f78d3a00e7

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia64.msi
                                                                                                                                Filesize

                                                                                                                                3.4MB

                                                                                                                                MD5

                                                                                                                                fbd84ac579394bb334c28855e36376ad

                                                                                                                                SHA1

                                                                                                                                5f3690e508715eee0453eed6702146e4a6dfd77e

                                                                                                                                SHA256

                                                                                                                                2c16b727ee98632939257ce129cc9716468565bc2639823f4aac0f6ebc0f2bd8

                                                                                                                                SHA512

                                                                                                                                a65f9cf41824ee5b541b217c913300a87974e2d5c6c16458cfa436822ed38abf42b5406349cb2e20823cadee1ece515f93d699943340cc71b9d83d75795dca21

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo
                                                                                                                                Filesize

                                                                                                                                604KB

                                                                                                                                MD5

                                                                                                                                80c019bb7f0c903d29af92d8934ff8e4

                                                                                                                                SHA1

                                                                                                                                cd9c542078afd2989ff0412a8aa571e6af6e9dd8

                                                                                                                                SHA256

                                                                                                                                f997273da1aa9c8f6e23be78adfaa68c7f32d4f3366583a077b1887108323279

                                                                                                                                SHA512

                                                                                                                                a55d9c732547b2dca7944d30097ef712f0f804652bd7d3b845aa8401a7d71bd69d472681de832707069f767dc4cb0c59cf69a5e5825232900085085567a1eb5d

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo
                                                                                                                                Filesize

                                                                                                                                785KB

                                                                                                                                MD5

                                                                                                                                f3606c0bbe03d9c3465e8fb58033297f

                                                                                                                                SHA1

                                                                                                                                7c7f7cb4dbb15a1335def4f2e3c721a242cc801a

                                                                                                                                SHA256

                                                                                                                                d6ecc156e9368ea4cba27f93203589db9af52e8190f103027ac07e84d99a285d

                                                                                                                                SHA512

                                                                                                                                d0570eac1345886d6c138c6538bf68bccae035a3a1a058206cabb085ccf27869d7bd60df2a9376df1793b352b2351d2c7b5cd132cbb5b4f92c1f04b8c40eb61c

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo
                                                                                                                                Filesize

                                                                                                                                545KB

                                                                                                                                MD5

                                                                                                                                140e2fb09d2f2b4ed9fbbc83927af3c5

                                                                                                                                SHA1

                                                                                                                                2ecec3909e4c4ab5eb7ea69014af1e997848fbb6

                                                                                                                                SHA256

                                                                                                                                f1f97b2a1e29f3ca48ebf1a174fe38439c77d1b4cbc4a4dba8442637a6f936cc

                                                                                                                                SHA512

                                                                                                                                a643edc3d52eb07db086938d5f59284c591b7343bc00b7364302c6be8496642540ca6145bf2dbe55613a22a4ae2b87178cde62fc00c839045b9138701d4def04

                                                                                                                                Download Submit

                                                                                                                              • C:\odt\HOW_TO_BACK_FILES.html
                                                                                                                                Filesize

                                                                                                                                3KB

                                                                                                                                MD5

                                                                                                                                a8514fd9f3a52ab2a00f57494d03b2fe

                                                                                                                                SHA1

                                                                                                                                0e204aabbd8b5d6ee1b36d10429d65eb436afd14

                                                                                                                                SHA256

                                                                                                                                056ae301d1686bbf2355fd96ef3363e2b18d593f58f912498d87de3569fa9028

                                                                                                                                SHA512

                                                                                                                                6250481712b51d19e13bf148e3cb046fbf669398b06f8ce757a8583a0fec36ca22140cb90d4706a731f27d1419795ff37ec079d170e15e9e2985020c1e6a1d5b

                                                                                                                                Download Submit