Malware Analysis Report

2024-09-11 01:53

Sample ID 231013-rgf5vaad3t
Target IN.exe
SHA256 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51
Tags
evasion persistence ransomware medusalocker
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51

Threat Level: Known bad

The file IN.exe was found to be: Known bad.

Malicious Activity Summary

evasion persistence ransomware medusalocker

Medusalocker family

Suspicious use of NtCreateUserProcessOtherParentProcess

MedusaLocker payload

Deletes shadow copies

Modifies boot configuration data using bcdedit

Renames multiple (7547) files with added filename extension

Renames multiple (4313) files with added filename extension

Deletes System State backups

Deletes system backups

Enumerates connected drives

Adds Run key to start application

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Uses Volume Shadow Copy service COM API

System policy modification

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Runs net.exe

Kills process with taskkill

Interacts with shadow copies

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2023-10-13 14:09

Signatures

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

Medusalocker family

medusalocker

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-13 14:09

Reported

2023-10-13 14:12

Platform

win7-20230831-en

Max time kernel

149s

Max time network

124s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3028 created 1236 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (7547) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes system backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\IN.exe\"" C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\IN.exe\"" C:\Users\Admin\AppData\Local\Temp\IN.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Mozilla Firefox\browser\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\gadget.xml C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341455.JPG C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\gadget.xml C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107302.WMF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200377.WMF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01293_.WMF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR50B.GIF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0232395.WMF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21315_.GIF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR9B.GIF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\OFFISUPP.HTM C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15060_.GIF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\powerpnt.exe.manifest C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\STORYBB.DPV C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107526.WMF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152884.WMF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackground.jpg C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ckb\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\picturePuzzle.css C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck.css C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\RMNSQUE.INF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01849_.WMF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\mpvis.dll.mui C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\Synchronization.rll C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143750.GIF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sitka C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115840.GIF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OLKIRMV.XML C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099190.JPG C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196354.WMF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\8.png C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\AFTRNOON.INF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00449_.WMF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18255_.WMF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.JS C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\calendar.js C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107502.WMF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl C:\Windows\system32\wbadmin.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3028 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 2900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2644 wrote to memory of 2900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2644 wrote to memory of 2900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2644 wrote to memory of 2900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3028 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2604 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2604 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2604 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2576 wrote to memory of 2896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2576 wrote to memory of 2896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2576 wrote to memory of 2896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3028 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2856 wrote to memory of 2616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2856 wrote to memory of 2616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2856 wrote to memory of 2616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2856 wrote to memory of 2616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2616 wrote to memory of 2508 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2616 wrote to memory of 2508 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2616 wrote to memory of 2508 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3028 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe
PID 2712 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe
PID 2712 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe
PID 2712 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe
PID 2468 wrote to memory of 2484 N/A C:\Windows\system32\conhost.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2468 wrote to memory of 2484 N/A C:\Windows\system32\conhost.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2468 wrote to memory of 2484 N/A C:\Windows\system32\conhost.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3028 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 3016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2620 wrote to memory of 3016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2620 wrote to memory of 3016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2620 wrote to memory of 3016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3016 wrote to memory of 2984 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3016 wrote to memory of 2984 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3016 wrote to memory of 2984 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3028 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2436 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2436 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2436 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2752 wrote to memory of 584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2752 wrote to memory of 584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2752 wrote to memory of 584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3028 wrote to memory of 976 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\IN.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\IN.exe

"C:\Users\Admin\AppData\Local\Temp\IN.exe"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill \"SQL\"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill \"SQL\"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Users\Admin\AppData\Local\Temp\IN.exe

\\?\C:\Users\Admin\AppData\Local\Temp\IN.exe -network

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "77387771-4986221071521687136-1174413471-8397377761414203941433412463-1592789621"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

Network

N/A

Files

\Device\HarddiskVolume1\Boot\da-DK\HOW_TO_BACK_FILES.html

MD5 a8514fd9f3a52ab2a00f57494d03b2fe
SHA1 0e204aabbd8b5d6ee1b36d10429d65eb436afd14
SHA256 056ae301d1686bbf2355fd96ef3363e2b18d593f58f912498d87de3569fa9028
SHA512 6250481712b51d19e13bf148e3cb046fbf669398b06f8ce757a8583a0fec36ca22140cb90d4706a731f27d1419795ff37ec079d170e15e9e2985020c1e6a1d5b

C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl

MD5 ae1684da3a0ab8c74013ca5472fa2012
SHA1 dc3ab9af8d1313917d34ebf4491b84e19bf8d033
SHA256 00e90f3df0950a1114ab5a059662853a3b3677a6089ef47d8cafa73959cf472c
SHA512 28e26c35f9ce2299e4601343a0a2eaec858d1859aebb0d4af74ffb4b22cedc4ca78572a6a17628960ac98f7d25ce92a6d8e8c5fda220f7c58ee9ba976a930819

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.infected

MD5 12e80c5d787ce4a23de903024ffc1ad3
SHA1 98ca2b8bd7c0a3488d99ba68681d4b212c3b889c
SHA256 5b64cbbefa9d11cb142b8cdfe1c3e6f7edaca90c7611344328f2e65391fecf61
SHA512 753209a1f11200003945ad12cdb7b5d0dce6474eedb6489f83b3236339cf869002c4304b088bfaef2be6f738d519639e5ff374bd4637f5f4023ea3838dc92f1a

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC

MD5 2def321833c862cb06f4359c6f5a8fc3
SHA1 d07af6de8d1ce4c38882c8691652e7646b53d68e
SHA256 44fd99acf698454e362798aa4078b7a6f2f257348d40924c999c79c8cbc3d1d3
SHA512 2bd127753a64742ab8423269bbcd871c4e86397f376c9e060cff769db4a07fa8db6282d49ac368f4ef8ac3d7b0739251b8836da5920433b5bb79c6cc2ae8c604

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7

MD5 cad6e82eb4c3cee7af06c4576b2c3227
SHA1 6f7c1aa7a7660c9a745c711332155e0985fde899
SHA256 1a3e23f55814054c1cc1fd690a391d3abdf8d70c7cc371a994a281757d5489da
SHA512 8b669bb587a4817aebb678db8d6c4218868487f6b452027cbc15fc94430dc8696f8c1a10887d1dbc9158ee274fc0ffde7800ff906278d42c24ba62fac79a0fbb

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10

MD5 d97a7660b794a4395ca43c44c064abe5
SHA1 00e36bffc82dcbd34485577ad56b04145a65e347
SHA256 55a6f75a2daf5d86c919d99c0f0a62ee30517c915c7f66e5aae7f66c0d9c67aa
SHA512 35be1eb6164b436e75ae8aa80bc087cf96bb10211d2056cd28f4d78ceaaf70f742053037b72dc265c88c21ba0351208c641f1b76537e045a7fd2b6c8e5326487

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5

MD5 34865bfa9a82583198d5413d5c7512bc
SHA1 ce73c8a26948497dfcf83ed28a5ae73922b098db
SHA256 0c7de15396a5156872571b00e7628fa9f7a498f3acb157e1724bbef7fa241cb4
SHA512 45e4a26781c0a0f84ff64a7e86e9cf5a9c42d8b6a66d64794bb660f18892ec824ce3720e546823861720cac2673f5e3e374823121c9e1bd0a89c982b3639a827

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 05b3ea3c8bacfcbdfab90c34f24c66ab
SHA1 32307cd59517a1f3d5213b8c6831bbbaee2c03a8
SHA256 452fdda59b424e148ab3789b30cd726df2ea721b0309b67ccf4d57b61d4b0884
SHA512 ff3099f88de0ffc133d7b072438ec25d45e7038f605c5432a0dbfadd22f7a31836034c61d91b7bd4f1c329b9321a0cd04ebcbe2bf0846561e632238502b6e6aa

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 c40596abaad92b3197485f5a39752eb1
SHA1 2a77426401c4884b47565a2acfc413101a4d5d3e
SHA256 719d9dfa0057ed42c1a4c8934ac6a49a82dcb49bebffb21df12a60a52e96c317
SHA512 64ec865664c1ef9e39ba7b54b291b293f33af7120ec826169f30e6311ca38f0d5440f648c7bc7fc25dfcacd5c5ca506375e0daac6768e166ef3240e96c908bc7

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf

MD5 da3cc8ecf4e8738f5cde51a9c9ce3fbd
SHA1 b632f11d80b4791ccf11080a96477e8212af4d66
SHA256 d5f05a1e386cd306f5ab86a9eaea8693a3eacbd23de48f66be60bba8a7d471e0
SHA512 43e5a76809900487cceb0d43ca2f1f6b54389b14ec735def4911a52d60ca32eb81c5c7157493938620738b804c4422f5ce37d2b63daa9f25bd7e38f6cc907771

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

MD5 62e6ac8c3c20949a2eb7a2e8d35dbee0
SHA1 056dae7324df5826fea3b1d2585928cc96052729
SHA256 b7980af569c9497ae194632eece488d180aadfeee85204bc225cafd3076457cd
SHA512 1827010bf829c3ac56b5818cb1c89c6af75022eb5b00471cb0eea252506b8c9c73c4924c68a3e298aaee4ac6d15f1f4f7ec2da0f28b0547bc58714c8f6d702d7

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA

MD5 42d2f2e48e5addae9996df3fed9fc50e
SHA1 d4235946a1d3e786d5b8cdd6944980433c231977
SHA256 49a284481703cefedf1096f76c030e295ebb2a234aa67b8840a39fa3da53ad75
SHA512 ba3c4e34430b1b075d2e2fe3ad67bea24d390a9dd9d283437c20e6264d292774fabd113fdd5bc6425f4a0670c1e0cec0da4b8089d74157349c697c251e11d6ae

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

MD5 8fcea588e0b91c507b795353e4575b96
SHA1 ec52503991e82eb9d44fdbd49414b7f355255403
SHA256 4e642e74a5cea8f8d9a72a40a252d829b026d806e46c16f2a180c49784bb31ec
SHA512 dda86b3f4a54121e86d1aac8cec7a0624cef91e6b3aa4880840f6c0952def4ae8d70477d2242f0bc1316862dc3813b912079de885ecaabd55961200265fe7c50

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF

MD5 d988af24e55e1967498249a19568bb9e
SHA1 1efc10c4b27f85e7f59eb3f2164955eecadd24f3
SHA256 eeca984c2d3a8439eddaebf4b86d87209dd7f9f10163911243f3c0187ed66b67
SHA512 c5f5db1642764cb7732c1a45c28530bcb9e19f49ad7f26b9dcf3020d2b6f4ef4ef17d389be6850ad5c89b956942909472e19e5ed836e78526e590cd131f618c4

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden

MD5 fa77a722a44c7affe1fe51cc5c637c3b
SHA1 72d19f9370710c82d70e11adad1de9bb949e3927
SHA256 3b72f174cdee3ee5f6c18c4de011f9934c8efa12907075604af6c71baf7d00f3
SHA512 aa2da9794d003a08c94b279986e75a82d8d882b2fad31004b86cafdb805c55b48e7837f2c0301173b936bec1b77b8bea9f60ff94c583d5cfed42a788709a337d

C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif.infected

MD5 ee5066d2219c89d8a59c4d6d9aa693a9
SHA1 b495e4b6b602183b88d43fc539c34b386c7a9323
SHA256 cdf583c6b91281d2b13f897e2c03c81adb6cee67d9403b5dafff6d4f4a84bc71
SHA512 f79e6ba1e0884d0bfa7e9faf5995864b52bbf14b1231a4b8ed7eae7b3d32e6e4e9426104517d368f1cbd7c21c4b974e18e66d514e53787068d6faa25f11966ce

C:\Program Files\Java\jre7\lib\zi\Etc\UTC.infected

MD5 5c30ce4df7b312aec925904eba6a78b1
SHA1 637377933cb7f4df82841d81d822353598c9dcec
SHA256 5c489fec32494e0d246830da64cb6d65810a748bb20195a9c817ab9e09164210
SHA512 f038bdd5b97e9061e9f1758058bb3573e6485bcd31c78c86b1978db86c43f9c4a2adc23fa6cc0bf10ee3e9a833ee38c8e983b5e284f35977a61385d0d4f80d0f

C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo

MD5 067a9bb9e30a27aa41817fbc0a711698
SHA1 c8f9a178cbfc55999148cd154253c12cd5cc34a1
SHA256 c625225f9a27e962423760c35275c2332f01052ed9844503daf69c73cc9a6202
SHA512 7621105f6cb12996584ec7770cab77ab363ecfcbc5c37d704ba1dfccf04fa56e82059232e505ce88413028321810b682d650813b992b45b1edcf9ac233237c7c

C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo

MD5 ef28384cd0ed45e20a614c8bb466e487
SHA1 9aeb59898d71cffc3d9d7f4ee1ab4f773920ac25
SHA256 0d34132c9c508db74e3d0eac04fdacc5154dcb2072965d610535df77e891c83e
SHA512 1c08dd6fc2a7115de7d317846411159ae3d4e32478aa6e78e5703286a7bf7e08ded563ef98df4bde0d19187746b4fb3554f3a5aefad1c0b80c83232cd8026588

C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_F_COL.HXK

MD5 2f8cdcf7aba39ccfca7fd64a819f85c1
SHA1 f98fcc7168e1260212698386b1148b3407b6f65a
SHA256 7a67bd858626c19851e5e9c954a7e3211a1b5a21850e67cd5b3dc7c1368194a5
SHA512 df77c643a9fd191e7b8d5f1575fbf4055d31777fcf09798098ebfbb4cfe2f0726dc1465a2029f3f1adcb9e57fd943ddd64a0de40a762302296ca0b3ec574aa41

C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_K_COL.HXK

MD5 0f5f98eebc8077028d268a2ca6df1199
SHA1 bd3f7af11181c26cf01f449aecf4d1bf2fe09264
SHA256 71d092c9e4db317bbb8c78ca8bc761938f56a651d1aab3e0d70f6521998febaa
SHA512 de6bd9e83c26681db00f45b3e80639a3516baf856cbceffb0f032f9b4307a36b1cead08213d2cefc793f47b5081da4c1b4ad02b89120cfa99ee26ca2df0db056

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\TAB_OFF.GIF.infected

MD5 a948f034647d635465fa18b35b33751f
SHA1 e3f56c1537b8e138ff4a25a032d016287ac4a637
SHA256 89d42cd49f683d82e1f278d90cde5bae3ddc33ad5a40abcd65277c3e08d514c3
SHA512 a048f62174ad07cd843c5b94ff53acfa79e0955a61d17475eb8723886652122425f284e3ebfbced7ac5b27e5ce8e8a65c97a41c7ab5d930ed5ca75356f33cafa

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF.infected

MD5 33b4d48ba5ea66988a1b5c8c5755bcec
SHA1 a7997ff539a55b82dd4fac08ba9b28591fc0bf57
SHA256 b07efb919c402e07ed482a2612209bdd224ad129ee3e7654f2cfc8dddf4325e8
SHA512 0d0e696438ef452b984ec81accaf1c0b504de95a47738f529df21f127d60c453feb1b872634fa590fde04fa5698da2b8bd8da30544d74f429938613850b98a84

C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_K_COL.HXK

MD5 cbf4795cb628f48dff57387baab90577
SHA1 257f20589fd15e779bfbe08724336b75c7bc0a7d
SHA256 f14ca6489c63ee7bfb4c86d5495393d61cce4de440bb9ab9d42aafa387b9f9a5
SHA512 043143f86d778ca6ef7c8e4f7f19b5fe89d639699558b0afcd4fa6cc234bf839de0491c887a93935927d9cd4594fbac5fd21ff04f73b8fa07720729f5ab44483

C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_F_COL.HXK

MD5 dd112c34ea7852acb71c538b9c60c5bf
SHA1 44edd61541075b35dc992068cc99e66453e7cb8a
SHA256 fae3f06a0f9545be83a804f09663b4290a22f3452b69864271649345b9628a74
SHA512 8ab7ef5422bfe234bc83a8dda8b3797ba44b18098d780c0586242616e42d7a002892848d4c77aa66cc1a43bc96c1520453496f5b19b86cd05469540c8b2fb48f

C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL

MD5 8d12b2d74338e6743ede9f5019c25136
SHA1 839f1c0e474c1e3bbc1466e7963be9e8559b7c8a
SHA256 5c5fdfed03da2c50d467735d128c05f11e1c8f76f40f92d620a139ddb6d2d7ad
SHA512 25f6f47542b8fc3fa05fa1a9a6a9508445b93605e98184434a6ec1918ee922f5cb83edd98aa35232c0cca90a9e7758f71369e14ae77ab3b48de028f55eca7a4f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\TAB_ON.GIF

MD5 9ab4091a99c802a0743d80a7bd371503
SHA1 b9d968931892802c5f76a72dc83328161ce5c80a
SHA256 ff1a437c4c2212ade9b5ccd57abb3957baf7fdd77c0549a69658fda97594f29d
SHA512 5cae3f1ce555f59ac877a369eceefea3fc8b373ea92c26a667e2156175dd1bce634fcfec9c7c2d2d7d9d7e51f29fc2676b7bd00b1453658df7fd238694531cfd

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\TAB_OFF.GIF

MD5 f701fc3a962fdb086df2703ed7a60d65
SHA1 e63af9979385b98cba61526d52689bb5ff6600c7
SHA256 17642714fdb261c47167ee90af0ebd7762826b05a6b2ad1d7c63284c4e92519f
SHA512 aae4975cb4ff5cea5e37cb2561374f8d14a9500c963c076117b212632cfa4c24d5d38bda15ba25bd6a8e8c7cd429a25281b1369a7325b2fbceb96956d51a5ee1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\BUTTON.GIF

MD5 5d5dd3d4422375b28f5f8cdd5981e6df
SHA1 3cbe4f0950e9d78afd8367bd6d93d43f0cff0f2a
SHA256 e58f45aabc6c199db728ebebfde4f1c37cc87c0b08532c4be5d45b79dc1f9e60
SHA512 9ee15474db9bae4be464c90004c743ab939d38ad96239d9d4691f3802fedcca29b92939468a2b7a83640abae64140a78f0b887f5f9326aa6230f465813bce547

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF

MD5 3b685853d01b7a9b26d9d1515bde81ef
SHA1 a37ab0dbe344d96a67463daa32e20f8194dab2f9
SHA256 3e0f72b9de9a05d7a076dc8be13885f23e30e3ff97e9b4293eebbc2aa630eb2a
SHA512 a74dcdf66e79e56b66e70aa2488fe749f29c1b00c85afe1b5caef7d5714feabbe95cd3ade234e288e289d0d81c6b14c800904b247272b02846e49cd6550d2eaf

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF

MD5 f6450d724b1bedadb74492bb6eaf9511
SHA1 f4e45c1d6d2dcd0405d73a3284b8e5d4ce31a0c1
SHA256 47d949c97298537fbc4e7cd2314f33f48769da3d0436dc15683b2c3da0e4b93d
SHA512 b163ac7444d8cb71ac06401206f76d5f4d9276c39fb109fd9eefa5f20b29e5a6ab199edad18f7d2d25c142e1133e2d5bf683dad60bdd6492bca173273094142d

C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\Microsoft.Office.InfoPath.xml

MD5 37f21b00f70ac4e640e635ec00b74072
SHA1 f66acb92b00bbb86042fb5e0b1ebbcdf362684fa
SHA256 c377168031e9e6988902b617203ab28eddf6c6f19a7417e812da764850fb56c7
SHA512 bcb6b22e8195c3212228d95501fa7f3c891c7a068df9dfed5a5c131026d079892577350187eddfc7c584f248f4760ca45f2ff1ff873f131eedfe618baa86238e

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML

MD5 8b80cae5aceabaf4c7cd48f6c94a8b2d
SHA1 1f1925797c3b3fade4f694f217e75c1e4dead980
SHA256 537bcb9645603c940b3ac7e8bd7f19c1085271089eea58b1bc97cb232bfce3a2
SHA512 1d22eca0dae2232879cc058197c67db43066a7b60b66b0501c3714eeaa16910569c3205474f15caedf408b71e935cb0994ab750f76665d3ddbc567279b64bcc6

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.PL.XML

MD5 73f9fefe6c7d71d3519f3c874a939040
SHA1 ea64e6fe49db254065ea4f8bf6129d6775bd3a2e
SHA256 9710596b9d78b2a3dd7c7a0c0865b07f97d39316468ef1953965e6b9c44644ad
SHA512 83a98a8e4167b0b6a46f968456c7840865cc0cc1323a23e7f39914e4cd9384c73f1d8a7cb6375c4db54e7d6119d143b8769ce994f666e29c75a19063ac2096dc

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck

MD5 b8832e3ea05def65d4b40ead3056fe65
SHA1 a686c316e6fcab9b1b997b8ff0da483e772657d3
SHA256 004f3c8cf2cb35e75cef1664f0701176b8bc591835b79159ba7aca209a39b789
SHA512 610043a7ded0b2741382a39a550e726a5dd7679281a0bb6a2479cc91bc8a7eca6733569557d876f989f3052927807cb107b58527c1722169b451da624d10b17b

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.001

MD5 aaa90f90fe41f8a633632e1899535f47
SHA1 e384f68194fa8be68b5920d0f9253c84d04ca314
SHA256 a522d22c529394ebf6d9d2433e53df264385a2e242f0de83933172e50fa6b030
SHA512 58d1a1cb5a05c06b723035660914a3ba4ba9e3c781cff27e465b01a467c0c2eefd03ffcd7f1ce4d23f107dcec133a8010fa366ae31d241f667e3f9d1999d8372

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAD0001.000

MD5 ca4729861d53f531a1f928009f0a39b1
SHA1 f7cddd530ab3e6ebafaf7cd492abf91c43917d6d
SHA256 92cfd191c73a8e58378bc3f94b9fa4b0c372ce77b9c3c54ae6126005733347f9
SHA512 4941b812cc12656d3cfec93cc0bb0f134d3ec58daed298761f9e42ceb843f44542010c402bb13b0a69ba8882d2958acc5bc6d286ba443e8d359347e9af984ad5

C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

MD5 982c15c10d641ddad93edec69dac4afc
SHA1 3f79023896935ba94db4ea57553f7b10886d3b99
SHA256 0cd0043b6650d1ceefd77fec0d5ded0997101b344304bce0adc377831485fbba
SHA512 bdd1c9fe85a56d5c7e471c0613b48856454e6e6bc262d536b868dfd0b7048c4fcd22f63bb588b9540077ceb4e9fa83ff1159041a0ca4b8064c83a35bdd5164c5

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-13 14:09

Reported

2023-10-13 14:13

Platform

win10v2004-20230915-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\IN.exe"

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2736 created 3168 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (4313) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes system backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\IN.exe\"" C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\IN.exe\"" C:\Users\Admin\AppData\Local\Temp\IN.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\IN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\derby_common.bat C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\fur\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\Pitchbook.potx C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\nb\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.LEX C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4 C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\SEGOEUISL.TTF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File created C:\Program Files\Java\jre1.8.0_66\bin\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-80.png C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\db2v0801.xsl C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ru-RU\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\be\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\COPYRIGHT C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\PNG32.FLT C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT632.CNV C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.boot.tree.dat C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICB.TTF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File created C:\Program Files\Common Files\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\COPYRIGHT C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\ct.sym C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\MSTAG.TLB C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.expressions_3.4.600.v20140128-0851.jar C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\msipc.dll.mui C:\Users\Admin\AppData\Local\Temp\IN.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl C:\Windows\system32\wbadmin.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IN.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2736 wrote to memory of 416 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 416 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 416 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 416 wrote to memory of 4044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 416 wrote to memory of 4044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2736 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 4268 wrote to memory of 228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4268 wrote to memory of 228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 228 wrote to memory of 1412 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 228 wrote to memory of 1412 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2736 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3400 wrote to memory of 3628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3400 wrote to memory of 3628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3628 wrote to memory of 4020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3628 wrote to memory of 4020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2736 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 548 wrote to memory of 4520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 548 wrote to memory of 4520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4520 wrote to memory of 904 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4520 wrote to memory of 904 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2736 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2124 wrote to memory of 4580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2124 wrote to memory of 4580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4580 wrote to memory of 2168 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4580 wrote to memory of 2168 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2736 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 4728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 4728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4728 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4728 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2736 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 4712 wrote to memory of 3776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4712 wrote to memory of 3776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3776 wrote to memory of 3676 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3776 wrote to memory of 3676 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2736 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 3336 wrote to memory of 5048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3336 wrote to memory of 5048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 5048 wrote to memory of 3024 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 5048 wrote to memory of 3024 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2736 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 4264 wrote to memory of 4764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4264 wrote to memory of 4764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4764 wrote to memory of 3148 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4764 wrote to memory of 3148 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2736 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\IN.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\IN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\IN.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\IN.exe

"C:\Users\Admin\AppData\Local\Temp\IN.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill \"SQL\"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill \"SQL\"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Users\Admin\AppData\Local\Temp\IN.exe

\\?\C:\Users\Admin\AppData\Local\Temp\IN.exe -network

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k swprv

Network

Country Destination Domain Proto
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 29.81.57.23.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 203.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp

Files

C:\odt\HOW_TO_BACK_FILES.html

MD5 a8514fd9f3a52ab2a00f57494d03b2fe
SHA1 0e204aabbd8b5d6ee1b36d10429d65eb436afd14
SHA256 056ae301d1686bbf2355fd96ef3363e2b18d593f58f912498d87de3569fa9028
SHA512 6250481712b51d19e13bf148e3cb046fbf669398b06f8ce757a8583a0fec36ca22140cb90d4706a731f27d1419795ff37ec079d170e15e9e2985020c1e6a1d5b

C:\Program Files\Java\jdk1.8.0_66\db\bin\NetworkServerControl

MD5 517030622648cca2fd2a7ee260d0d40e
SHA1 62b4edcc1128caccfa5fd2f09342a14d8a749f80
SHA256 7c772a647ab695a20acfa19cca200864747c12893220fdf2d16efa885f84cf44
SHA512 b43e7caeaf428397b7428ca597ecb004fc35fd117d7a8714f9483e3f96ef58afeb7c193a65b5644ce531ac00b39843efac3b2840f0b31d9b244c29ed34c239cc

C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 fde084dd5c0bd9a1bc800ab9367360c2
SHA1 3daeef0e1d266783c2ea8c33080bf5d6c2b41636
SHA256 79bb4e4d2a6bd2e7a90c4af2f202a608b75d1e6b3423f33bed08662e6f22d58d
SHA512 1a4e7c37d219a1de88c6378fc4f6f71751295d07011da378e6686b3c43a2df90a76dc2e7bd84057182398eb995b1036c5127761fa416b0b319ebe8e10d45353d

C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf

MD5 50fd416e4e7291c24d143633f3c3c40a
SHA1 d8f6dcea6de3d2b76fbbc748b778f4a46436612e
SHA256 5b58931fc6ce551cefac2bc45c2144cd1364ff85b945420266b41e34b26b3546
SHA512 225f19260c74107e699f4394a93b774765f6b71044233fb9f07e56c82d6df4ff2783c16d4db733c2f195effe7a2f02029d50e1e1694fae08951fe3e62dde1f0f

C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 54cdf6995522b0271700e9063e4417af
SHA1 a19b04acc2b9331a72f3652606a2cb7889e205a7
SHA256 ad7be7aced6ddc0e3973500a76a18b7d48e2b617d33895057fbb84a3cef90159
SHA512 22e96d5a9b02396c507309af2713742418c03f0a86eeb2f47a7e1c6e164af2f90e301a9a7a8c5528068417fa5b0b283af8a56e7c72985323615657b7a2a2dc35

C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 45e488eba92dd426856823d8435af54a
SHA1 6f038f31ea2eb3ae435495941b68a804a1cd3717
SHA256 a5eb3140b0cd4475d0a4093a65500cee957287352db0cfc5c47cbbaf0bc51b7c
SHA512 c7fc0ba3bc151e987fc1ea7f4c2d06617f9798663abedcaa7ac7e72a18a435ded960b2dde477e85913cc49a1af3accd801b52a7c32c8c1e2b7290cfc2dc005ae

C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

MD5 ad6d95a9a1f0e0f0c4f5b9bdd9b59994
SHA1 decd3f92b258c9c35b54fba1481caed99aa3cb66
SHA256 4f8174fe747faaf4d129210aedaf66dcdba8941b8d171ffdab89c3cf4c6bc60c
SHA512 2fbdb8aa72c6d9923eeceb9cc92dfe3a7fe93fb4dd7552a0db27f39baa435b8ba7b5cd30986eb113a7caac8c890a2e087e2813ad2aedfd1adf6df6e3100396f6

C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA

MD5 4f66772b904a6ba84215de0942b101f1
SHA1 f5ee56182f628c07771e7989144e8b975bf7ae8b
SHA256 0c5e848626a026d3eaae9a77dafb4105a8f26bac24b555875ffe9772d8a4ab44
SHA512 3c6f3476c85af7d2f9673abdbfd82aca207582096c800086f6781436908ce18eb42cb95df52c024fa0bb779184da34d7175158b3197f85aec18077ec582babb8

C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

MD5 2766d9dccb5f77a06e269712792a5f2f
SHA1 cc6dfd2bc86049dacd6a4a45e354fe003b0e7e23
SHA256 cac7b85c6ffbc161f2972f83115b11c6151bd6c2e61280e50f8963e25c90fa64
SHA512 3813dcacb506e1c3a88ec7aa4bfdace337b60d5e9f2bcbf94a2cce063f311c8af18adb5e75727698a671961bf51631685e2f1aeb735df7f0fd46590fb68fea51

C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF

MD5 0eebed49243dc27eb75137a417d2484c
SHA1 0113e3a62a27a4964ccddf2921fc23c379572939
SHA256 cdd4e73d34bfcb74e42c12cd1bb371e8a0cb0d4b553e0760866b8fb87f09c541
SHA512 bc9fc0b3cb4c82fb69391992612749c26e4c61b65e9afd0f21cf1c2911e6c844d59e849c07ae8e0cf14c1d547259f0c3ab1563bc0a474f86b4cd50aff43cbafb

C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.infected

MD5 b628d8af9c008f0ec238d0dc3ff630fa
SHA1 512dac35f545289fb62e4563f728fed96ef6ac31
SHA256 7e604bb2b447f63b75071fc1bc9942497ce93011385790aae58726763cdbbc7a
SHA512 fb34b4e0462e7d646499535241d613fb08b967924c8c35b50cb18987b4bb1e9495fc1e2881d1056a73375e1f5b0ee0e08ae77345a8b28c1010a8322e0499497f

C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\win32_LinkNoDrop32x32.gif.infected

MD5 5b16d5f87b5b868d6d8c4317564ab585
SHA1 fa807a427d930c17e4636085a5f838196a7974ef
SHA256 bc6b89272e84719fcc8a9a70b1d31bf9d21b55efbaad8f5e4238a6257d6cc51c
SHA512 fdcf386ed06d706ef66005df30bbaa3cb77d0d8c2ce9c75c46fc54c8efaccec4ff95beeb42e03b119c72a23775919b97deb2009c6d0d17d5ee6a087a4e6e5c16

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 97588854b5b566123a910628f55d38e8
SHA1 b360dbb6980e3fbe0171ff96c8fa59cd1a9abca9
SHA256 316b7fcdbe4c3b6a733d2917c16813da633671465b8f279d19dae7494ef1fdad
SHA512 58f60db4e22a320a5d398db369a1de1cc2eedc1ca1b8e6b664c8aa4e6ce304d9f58eaa6ab0c1ac5211980810466bb8b4f33ddd27e6d2eed04dda6042bfe688b5

C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK

MD5 4cee9dda64b76e8198011adc9bcae31e
SHA1 ee06aee0b681a13fb323d720b85975b40e307b99
SHA256 b3e19846cdf7c9b11e874b72b0d8fed77e58a4dad7a56168aea8103bb6fc2522
SHA512 120108ccc1315340848f8b92854d3a180182bf0246a930844f824ea959e5843ff8c9c2041b7e2a21eed56d636227a41a78a5efc05076349419a22c644d257fb9

C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK

MD5 5f37d74a5b4de217526aa2324738091e
SHA1 328c1a943b761727615f1a9021b53b7381ef3c49
SHA256 3c569eed99144a905a15d68f11f522788a05a0dbaeb285656c525121ca24e40e
SHA512 bab06177e70f741e118506a912a6c18fce2fbf985a9eec425d74b8a1ca62408f61ebbca973b6e62155016fb24bde6792796501359de2992567ef79facd545a3b

C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK

MD5 07c1c76e039f541dfa684214fdcad36a
SHA1 1f8a0a56196ac5d03fecabe840ec45dcf993d17c
SHA256 62b67a274f2cc9e4bf492e3e7896675c882506205f3ee82138ca76541d7e019e
SHA512 9d1a385d915d7a1edbd2873914986d20e5cce1febade9461687bf615a82d2e352107e22085abd3d146fc760b6f35dcec3180d48f1acf2f6c57d5b77295d394a5

C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK

MD5 2ee850eadf9f86968e844b51a27bc77b
SHA1 a3e4b052a10997e91e4d2052431b0f0c6ece7750
SHA256 b435fe30e717675ae27549660257dc71dc3239feee200fe15b2a40622294cdcf
SHA512 070fa8590096ce046b5ec809f3c16523c0b528ef40a8a364c4dec5d04a6973b2879eafb63bc35852255893cca770cee1529c26729daab4b0e7139cbf8e4c6248

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config

MD5 02490ed77c703a220dc4b2b896b5f851
SHA1 a3b17b0eb2f82f46434140a080231fede5751866
SHA256 faccdee32017afb7e3413aaaca6fc33f74314493b9b3a67330a174091be2c7a1
SHA512 e834c993ad6771f9e0a5fa1b40a608afec642361daeca3693f9d9d5a03719430db53d037ccfbdfbbe3c91dc2b96074e7cac448db7c10e4e7d2af42014c16bb54

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL

MD5 c30647ddc155959b172c7f7032bed48c
SHA1 d5626d6126327605d06cb5f3f8be84be51b73de4
SHA256 60109f5d74fb328d868e4860e3bb6216563215098baabe89854c0222e0cd18c6
SHA512 cd14eb1343bdb96a146b86bd006991366bd074e79fdd1e32cd2c343b8e6dafefdb016e3357f277b086371046684db60770640eb883ee1b717fb640465c358706

C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub

MD5 e91eb6e85baae6e6ca6dbe99849d3738
SHA1 3c38093bcd630ed706ae4ed8b70772e9d5dbeef1
SHA256 c403b062888a6ac79c4cb424cfd8624656b2c8635aac9d7cfacbcb75b69b6e8c
SHA512 ca2336efc92c49382b98f0efefe52e5368c0533876ad6e67bd15a20de6c695f1cdbc60d5e58765cad7252ce22377e88a850fa9e5304741ad038842f78d3a00e7

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia64.msi

MD5 fbd84ac579394bb334c28855e36376ad
SHA1 5f3690e508715eee0453eed6702146e4a6dfd77e
SHA256 2c16b727ee98632939257ce129cc9716468565bc2639823f4aac0f6ebc0f2bd8
SHA512 a65f9cf41824ee5b541b217c913300a87974e2d5c6c16458cfa436822ed38abf42b5406349cb2e20823cadee1ece515f93d699943340cc71b9d83d75795dca21

C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo

MD5 80c019bb7f0c903d29af92d8934ff8e4
SHA1 cd9c542078afd2989ff0412a8aa571e6af6e9dd8
SHA256 f997273da1aa9c8f6e23be78adfaa68c7f32d4f3366583a077b1887108323279
SHA512 a55d9c732547b2dca7944d30097ef712f0f804652bd7d3b845aa8401a7d71bd69d472681de832707069f767dc4cb0c59cf69a5e5825232900085085567a1eb5d

C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo

MD5 f3606c0bbe03d9c3465e8fb58033297f
SHA1 7c7f7cb4dbb15a1335def4f2e3c721a242cc801a
SHA256 d6ecc156e9368ea4cba27f93203589db9af52e8190f103027ac07e84d99a285d
SHA512 d0570eac1345886d6c138c6538bf68bccae035a3a1a058206cabb085ccf27869d7bd60df2a9376df1793b352b2351d2c7b5cd132cbb5b4f92c1f04b8c40eb61c

C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo

MD5 140e2fb09d2f2b4ed9fbbc83927af3c5
SHA1 2ecec3909e4c4ab5eb7ea69014af1e997848fbb6
SHA256 f1f97b2a1e29f3ca48ebf1a174fe38439c77d1b4cbc4a4dba8442637a6f936cc
SHA512 a643edc3d52eb07db086938d5f59284c591b7343bc00b7364302c6be8496642540ca6145bf2dbe55613a22a4ae2b87178cde62fc00c839045b9138701d4def04