Malware Analysis Report

2024-09-11 01:50

Sample ID 240227-v8vzvsfe61
Target 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.sample
SHA256 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51
Tags
medusalocker evasion persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51

Threat Level: Known bad

The file 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.sample was found to be: Known bad.

Malicious Activity Summary

medusalocker evasion persistence ransomware

Suspicious use of NtCreateUserProcessOtherParentProcess

Medusalocker family

MedusaLocker payload

Renames multiple (7532) files with added filename extension

Deletes shadow copies

Renames multiple (6544) files with added filename extension

Modifies boot configuration data using bcdedit

Modifies Installed Components in the registry

Deletes system backups

Deletes System State backups

Enumerates connected drives

Adds Run key to start application

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Runs net.exe

Suspicious use of FindShellTrayWindow

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Interacts with shadow copies

Suspicious behavior: EnumeratesProcesses

System policy modification

Suspicious use of WriteProcessMemory

Kills process with taskkill

Uses Volume Shadow Copy service COM API

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-02-27 17:40

Signatures

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

Medusalocker family

medusalocker

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-27 17:40

Reported

2024-02-27 17:42

Platform

win7-20240220-en

Max time kernel

149s

Max time network

121s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2240 created 1136 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (7532) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes system backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe\"" C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe\"" C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\SBCGLOBAL.NET.XML C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\security\US_export_policy.jar C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00454_.WMF C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\J0115856.GIF C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCD11.POC C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\ResourceInternal.zip C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado27.tlb C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Windows Mail\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\OneNote\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME20.CSS C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ka.txt C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\TAB_ON.GIF C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewAttachmentIcons.jpg C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\currency.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\RSSFeeds.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGBOXES.DPV C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\flyout.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL_COL.HXT C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\Microsoft Games\More Games\fr-FR\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Windows Journal\es-ES\MSPVWCTL.DLL.mui C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\0.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106222.WMF C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107452.WMF C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Oriel.xml C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\nb\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\lua\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\slideShow.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DOCS.ICO C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\gadget.xml C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090777.WMF C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10256_.GIF C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\INFOML.ICO C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\it-IT\MpAsDesc.dll.mui C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\slideShow.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\jsdbgui.dll.mui C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-dock.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Edmonton C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\36.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107316.WMF C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME33.CSS C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LTHD98SP.POC C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl C:\Windows\system32\wbadmin.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2240 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2948 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2240 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2524 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2524 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2524 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2592 wrote to memory of 2604 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2592 wrote to memory of 2604 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2592 wrote to memory of 2604 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2240 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2696 wrote to memory of 2408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2696 wrote to memory of 2408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2696 wrote to memory of 2408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2696 wrote to memory of 2408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2408 wrote to memory of 2744 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2408 wrote to memory of 2744 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2408 wrote to memory of 2744 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2240 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2632 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2632 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2632 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2632 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2692 wrote to memory of 2492 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2692 wrote to memory of 2492 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2692 wrote to memory of 2492 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2240 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2384 wrote to memory of 2444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2384 wrote to memory of 2444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2384 wrote to memory of 2444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2384 wrote to memory of 2444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2444 wrote to memory of 2452 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2444 wrote to memory of 2452 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2444 wrote to memory of 2452 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2240 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2868 wrote to memory of 2308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2868 wrote to memory of 2308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2868 wrote to memory of 2308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2868 wrote to memory of 2308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2308 wrote to memory of 2008 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2308 wrote to memory of 2008 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2308 wrote to memory of 2008 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2240 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe

"C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill \"SQL\"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill \"SQL\"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe

\\?\C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe -network

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

N/A

Files

\Device\HarddiskVolume1\Boot\da-DK\HOW_TO_BACK_FILES.html

MD5 a8514fd9f3a52ab2a00f57494d03b2fe
SHA1 0e204aabbd8b5d6ee1b36d10429d65eb436afd14
SHA256 056ae301d1686bbf2355fd96ef3363e2b18d593f58f912498d87de3569fa9028
SHA512 6250481712b51d19e13bf148e3cb046fbf669398b06f8ce757a8583a0fec36ca22140cb90d4706a731f27d1419795ff37ec079d170e15e9e2985020c1e6a1d5b

C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl

MD5 ff9cff4e26edc30369ff7ce12139f447
SHA1 c086efef7e0dd547c7dc5d55880b5c465e5906ad
SHA256 8fdb57785ae79c64cf8092e6674429342fd899737818e068a66286eaaf9efc4c
SHA512 b77d58fc0198c633222a7cd05a6b00e43e159de4181163a3aba9f8ab68044f30472c8ae41b6dc0e99c583f6383573fbe321cdbedd14dd8c5637dc4c130663d96

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 55d19a3d1453f4423bbf707d73e2548a
SHA1 3a260a14105413c24e1a684ecaecfafae871c017
SHA256 2d35c0e59bf28908ca2bf755da8d544665e73a3b855e88b50bda0f1cb4047435
SHA512 fe9fd9bf7afba038fb285712f5d1009654f9d2fb580141ed1bbd7d72f318dda6cc1f794b181c78ce10c096a26841bd4a95efe4b3067655772649f56a41b89b8a

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC

MD5 25552e5319259e34f7671d90fe00ae10
SHA1 41daf2229f76716597d51b526d19ed091f45bd89
SHA256 ab8251355ce84afa9ad40a5fd5f22ea7ccbccca8f61823a82e29c07176f8b6e9
SHA512 8b2211257701f35b0eb63cf5743f3fe5c31d88b2a7fe2986df8e7c03e4d7c690e1b48e9d50411bd8912c4939cefbdad2ee31431cc53deeb862366b0ad2966efc

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5

MD5 0b798faf405a8cf58a8d10872bbef58a
SHA1 fff0299b30c85b6e30af89d72704016e6bdb4cdb
SHA256 fa269b8c21150f8ab8cac53d86a8d2da06e6abc79d04599acb7ee52c8bb0de5c
SHA512 d27e85bc7aa929f5aedd907dc32250c0de9f498a875d9d98b8fa2469a0cf08f8497913740cd79a81efa52c45729f22cb56aab7d4cba1c5443a4b1c599f612061

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7

MD5 2cc723f3037c81051e0336b84e7e4971
SHA1 17da55357757d8804324f766fb446bf051b73f2e
SHA256 45f686097affd721e14154990af7c9c972e32d90de5fd3eac9ba50f3574b177d
SHA512 811783adb3fe10d77edeeccfc84e82b476bdb2410bfc1c2ac4df0bff04cc68729e9ab1a063138540ef0fb1078ab5ce6fd2d554695dc1b603d6c7004dc7efae2d

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10

MD5 27dade11754f580cc69cd88f757e3679
SHA1 f08ca21fe0a1da2804e14cb63e0e40c9f5218971
SHA256 4d80ea3edb09949abeb48cfbbb6ca24e4181d8310b258596a0672d9800a9b97b
SHA512 3d16c519885a295ee0145501ecf897b04b8539554b812aac5f8ec72cf0e4aa680ef6bbdc705209b2fb5a601ece8410f0b581e7c5e605d21d584504aa6914693a

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 0aba8ee76bf146b9824e5724868874f2
SHA1 82a55d30ac89ce3ffb27dfff41f034d763d202e5
SHA256 ddc9b2b090a9a3f69b8de62e0d92d2cf53d95d4e28a1d9a11efcc773014103c2
SHA512 8e31f60413c851087c19f035a7994c065781f7df02e107589ac84d56c788afa2da3a44862062124726ec0d193041b2a0051f1e740d9aa88417e38b1e9ca926fa

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 3a9cbe6294512e0813ea72b0d80171bb
SHA1 32d7629272baf62cf830ed9b0256eca0ae71200d
SHA256 a68bfed0e712190107371a86b8d5e0a3a3e8d522df9ac3cc4976a8ac872d40f4
SHA512 2eea6496a791fb776f47b8ae7945eeb8b226109930939550e241acfcdfb2219e133ebfe6332fae5cb2b54d9b2f76e9d7f9a0090e2b5a81f33ec410cda432b81b

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf

MD5 9c03f25897b2876013451ac879180348
SHA1 d3c180300ac3c19e79ba6124be7b68beae489de6
SHA256 c0e638f2ec3f6994251a6c5c101e426f369a4e7077b6b0645c52d1e5c1a242ab
SHA512 b74ba35a43194f7f28683a282d5b048d0b510c5267f312dae4a2d02cc35375f86745a6c935a5b0daf55787d0ea0f4cc4439e6d361660d4dbd78714aa2bba059c

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

MD5 1b8a4400db94f6c61c6052a2c875f71e
SHA1 23a087449bdaea4e7b2050dc954c34f0efe68a29
SHA256 88e57ae2951ab25699314a77b01a1780c547641fc585ae2536d04af560458f86
SHA512 91986352062e79a02b632611ffe02d9eda4574f743a314fca504a14404b2d8cc09c05f928936f060854515ea38cfa2f320bb9a1d8939ca7d96bb05aeef7cc9dc

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA

MD5 497ce176f19c86cae10edca9dc919baf
SHA1 0eafc1367c8653b0837b9f32c88022417435aadd
SHA256 0b6b9c6618ebeb600ac6a144af7a3c6bfefdbaf82ed1606ea924b226517272e6
SHA512 3f8605d7d1c3076e7b4a48272ea89298017f0efe683fa12de1be01a1194b9b8b49a0316dec378ba535f03b0e463823043cb938d89233f9737a61ffc89d5a0061

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

MD5 a727e69d21d3a4f6887fba45976ba053
SHA1 f53e22d0f5c0f9132f3656f58087087a9b1e98be
SHA256 aec37f2ec4330c22c7b71f182943a2eac9fdd5ac022595219e3f5a26e55de427
SHA512 c629d9363835a3993521d2d1ef3cce1c152cf22802d3fd1106175ab7c6ac5045a69be6ad66e8002d5441a83beffde1233530aa53743baacc991565b3c8962e96

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden

MD5 86e32b11cf78c9f711e68030bd5a2138
SHA1 f95ee4b23490b0ef6821951c98f02ce0e539fc82
SHA256 8c0fa675791d51bc8140ccb003b0909ef33f7223ab45e48acff560e14703058d
SHA512 e9be44b873e22f0195f7666424125beac0a9db9b5c634e2c36cb146497d62b2b10746e1d54774176efa122ced6e5caa96db7b71c3862484c95f80fecdf899ff4

C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 fe9962a00a620a0eff16eb9869d69c8f
SHA1 806d1d328b17228acd28987738f3c718ed307ef4
SHA256 a23cc977887c4c6faaa91817f8c4d71be71d7fda63041b3c820b78984c5f3c4c
SHA512 9af3778b891ac25708620a52fdf140e5d6a599eb9d434258eaf1a913490e92c3f797696c62e309142b6b47739a366b38c02a715a6c4fd4c60f86faadb17cbc6d

C:\Program Files\Java\jre7\lib\zi\Etc\UTC

MD5 930e27a91befa2e786be817dfa614241
SHA1 9c22c3cf830dfc7f2c4b1da45e474e132f05b387
SHA256 c0f23f24d1d0a7a931d25b0edaa64f32183246c249c4098b62d0408df5d7cb5e
SHA512 f7a0ca11ca10b51bdfb678b49e4381444c9aa01a7b2f8e15f88131fcfe63fd4e8f7da02a494b22e563b475b354eb24fff6bcd7af555481bce06db95f338e75d6

C:\Program Files\Java\jre7\lib\zi\SystemV\MST7

MD5 7349d5484f765ce6e184bf19821be5d4
SHA1 9ad024750455f230a63ba99d8fadb0f4cb0d2be4
SHA256 2f991ce4fd4fb98ca235a89f1eed8113711c57c920a45f973fa350bc46ab8e15
SHA512 32fe9611f500f33f14c15a49db5768b93ea776f794680cc6e971ee6d1e4448a881b281d66d29bc9af035c719a1912dfa271c521289cfd5f492df0ecaf74dac06

C:\Program Files\Java\jre7\lib\zi\SystemV\HST10

MD5 7adc24fb29901a2e9a37afae8973bcb0
SHA1 1e29e7d6c788a85adfc93eac792403a0c05811da
SHA256 0ce6413a74318cbeed28d87a8833e3350a4408310d0eab1ffcb9f49b57400d9b
SHA512 293051aa6b0d5116f786c691b0d4b707f6c58a0e3db9fe113f08d8adf055c4b244f69b02f7bb5a4ff49b14f69d077cd99732caa1f0af3b4cd5e6e10b83cc953f

C:\Program Files\Java\jre7\lib\zi\SystemV\EST5.infected

MD5 a560fa2c3c4a3ed12264a80c3bf05b2e
SHA1 67de886f76e6cd8eb548f8cc7c9f945c6fda2530
SHA256 c890bef39a08441985ecf197346159a269e256b8a21c214e74a862f77ce1f4f1
SHA512 2ee0af6e0c43f2f1c0b0800c6c049d44ffbe28d435a52f2da3a19fd922e82ad6f71bb460dec0689c0914c0b4bcad20d51cc2e2cd5f04f34ddd134a4b1850d727

C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo

MD5 870b3a5cc25d13bd137c3deb1596298b
SHA1 9821d449ecae2ab7c4fc52784eb1e475c0f1685b
SHA256 112180f3d57d851aac2fb090600ffe1acc60b357a3e5006ffd7cfccaec20cf69
SHA512 1a8310f149211ef59c74c7fba7e9a001ab64f1215963e1b99025b74035916b6dc5ee8f9198e98f920cd3a2a3a2fcd5254cd54a2cdf1b37c3003375ddb8f65873

C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_F_COL.HXK

MD5 451887f83a288ee6481dffecc6c06d84
SHA1 6da634b6d503e92489dafed9dee159b3bccd4257
SHA256 1a7c5b79be33802a8ee57dbb4aa417a4bd1b3398810b0d24ccbdb42f95cc0b88
SHA512 e0b8180435ebf88588549ef2e212497cec1636357855c0d89f5a4009eceb9ce314ce40b73049e73c25fcda343d1c8cacc6e9495d0abde6846a1298f72cb739d4

C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_K_COL.HXK

MD5 dd307c7d4fd5b61f4e46b7e9f780fae2
SHA1 4c6397fa4f7f7be472fa293b3f0370f28ea653d8
SHA256 d7163a1960e49743b9d1eb1ee15a32a86e9a73d95451c65df3d341d41d0d583a
SHA512 9f455559de4f16a341b8e72395db0cc6986bb7ba487dc4591cb50ee9ac11c715230323e2b6d67bce45a168f4ca99349c786756f36566d67c3797b65ef669fc9a

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF.infected

MD5 0fd5f54b057d76145e01a1b15b0fe145
SHA1 cd1c66ea31badde05a7fbe7f5f17db02f8df536f
SHA256 1a5e0352cef9af331479197e766664751e07b820b223e2ce2c2ac9201cfd4b6b
SHA512 94551670d2c16dc2ef469b9b26164c22a2a40974b0e82d8287f844e5cc18ef467be90de5d89b010c7112e7ccaadf4bd4ef572f9d616273926917d42a3f220449

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

MD5 2bcfc9dbc6b6c3bfffbbe63a523a3b27
SHA1 3ba19d9a2ce346750b830b6c00c9e4e0af57a6a6
SHA256 c3016670d11f0de8a451f931ad27c107b742737e05138896ba050e76bfb5a3a6
SHA512 4868c740656efcb394237ef9e4d924ecf59d17ccfadeffd6679e29017e3953fb64dec5031be08ff042a2882cf2f67fc0fe79b0f357b2c96a596f08395bf4ec0a

C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL

MD5 48333ecea9c37c8dfb617b70e14aa581
SHA1 ed5d174e02c79e5bbee7beb73def157ed6bd4893
SHA256 0537a3a8c58dcd534451b20e7411bee96e39b4956920e39f9c07e2fde1f5ed38
SHA512 62d39661227fcf38b0c5d57337da1789227c82ede0f45a72e6f071d62430ef98d0cb9915be73a2148417be0ebd6b63e775dd98db1951d40652e1ed922e8bd317

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\TAB_OFF.GIF

MD5 dc19dfa79f0a282fd4a8115ad351de7d
SHA1 2334b1b98c8cd7f848e7c668e7ed50736f437823
SHA256 685771b5261cc3b8619a85007bdcd9e71c7e0dfa8f81360c179ec7b6382661fe
SHA512 8a5feec5707830a1d3ff1c97cc006193ac82621dfd847fb9a8a0af042ff5bec1803de2ba884a69e7dd83f69f79dc05f77c0bca9c5fc3db03fed556d0abed8620

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\TAB_ON.GIF.infected

MD5 769f5b308783a6ff3dc18f82bbf3833f
SHA1 f5c89793e735be6b38b6f96961df564be23ec36c
SHA256 f8baa31d314477d77fab96ffd1f8ef61c9151db2677b640574f8de1a19c3a360
SHA512 21800f89fb3f47dd845beaacceb13a07e7e1a3e38e8e168eb268f01a3838796ea1bdde5e802991234cf178c819b657fcb4a025db4fecbcc798d53cdaeec179df

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

MD5 f7174e2c275f8e226ad69e1d9abee9f2
SHA1 41634ae9a709b06bbd27b89f0810fd8db0cb505c
SHA256 791a59c80f120d2c5e7c7da1eb7c0285307611921cbe3ef2fd8ada5f090570da
SHA512 b6d911d38beea0edd24c4dd872540f17bf18307d312ddf034800b9abcab5684ba8be736233500ef299aa890f8edd95f90d06cd5b740553b0d2518ea6c30f8359

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

MD5 77b727cc4b7a86df83194f98a41f833f
SHA1 6698fe153e96c98511ef3f7855969bc0c25ed16f
SHA256 97efdd5b8814bebfa0f366166da98833770d9a38917afe3300b0249c99f43149
SHA512 bee8c603ad9f5cdd131eaf7cd11b9b6dfade7f1c2a3bf866f05884525938196694b4b8239c5ccc4fe1cda40534a2256459cf7871c83bffd77db354d88a0e68ff

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Earthy.gif

MD5 4bc65ec9e225da8cc3de908cba797ccb
SHA1 36cd1501c10fe19dc3c6bf64f7615d76917eafd5
SHA256 59401fb16556372e6425f4defaba0daeb4fc8d28e9527feaf8ee0f76d757663e
SHA512 58b9c42adeb8803720a962abe868af4697d3d2fc8574c1b5dc20756efbf822ab25886d92035c044de48a6658c558a5920b42d65aa27d0649f75d850a0411a0a7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Casual.gif

MD5 f07588caa80ef2f1498f3d9bf91d4edb
SHA1 7280c3457520ee43fc5760f384355a4ede7ff3b6
SHA256 e9df3d827bdcd161024e9ecb3b68c6009c871fb9f013e4f86e03a87098f1f3a8
SHA512 0ea061e139d604f766638aa4c413070315a167070ae16f901655ab07795e119ce953ba9de780cd1399c062b321172111ed831ad74137471e476cdebd03da2639

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\BG_ADOBE.GIF

MD5 327c3d50d7ee54006ddfd323ae7ded9a
SHA1 0e916beadc7ca45dfb835ad82d7d52474ea46135
SHA256 7df025f0896dab14f27b511a3aeefa517f3c22c123714cf99fdf00ab1d3fc8e8
SHA512 a8834a90e886242adb630cb20b997b2dd5c4990ddbddd9ac9e6897895b7a60800d8102fded2edc5c161aac75bddb7f8db70bdb8553d7e9ad0da6713617b59ec2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Country.gif

MD5 0196685d74976e5e9f8f552a601d201c
SHA1 fb11ec2d4762318659fb75a45802878de99d487c
SHA256 f4aded838780930662d7a98759078b3f8f7e87e1828c34116b509da2f13e8d83
SHA512 f2cfa43e3a46569c7a5ff9df7857a09dd5849ff380abd24ad70d472af59a2e7dc3c9b8283b073c34ba496573c1b69e7b9ca05acdb9d386cf1ca911ef07f035a7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

MD5 8fbe172406b28888ed66f44388c098c2
SHA1 4cc882e55fa341167d069431e30b408058179507
SHA256 2040087c77265e46be6693fbf922cc18f49ecb122e3f5c17642f9382eea9cec6
SHA512 54d59d878a5e75c6b14d75e9efa2dc98973c45ab83af5413cf2ce129d07be90de035e7c4eb14dfb9ffd153f34dbed4248058a1ff2e1c697315c24ee1dd17270e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Groove.gif

MD5 7675b54c06217c6a79e98c80481a7625
SHA1 98fea3358d8d4a155a85ca30dc3861dca66e0199
SHA256 447ca3c602e384ed89e9d5081a09890eb833d2b25ec7726d2a5c91ec0ef382a7
SHA512 645e1b3980e503bca96480c59227ecbd78f9e241687aa7ab07a69c4d2d5fc2fd7b9e9f82cb99988251ab523f0b81547a051953a9c9e3c49d50a574423ad79d80

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_LightSpirit.gif

MD5 5474506917ac9bd6c8a33f39eee4fd4a
SHA1 a483ec3d818ec90bd61238b8d2bc2cfbaa4a505f
SHA256 547d39216abaa31d0a70c40915215a770bbe8590f16723ef293f9b895792f1f7
SHA512 77668f2e766049f37cda816fe9e14c3ab5bfd2a67c5a4151d5dcdc611346f288de5cad9a65855762ab96a408fbe6bea982682960df336f448fd5faca147d7364

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Premium.gif

MD5 68d5d4a3cda983f3e2146c3511f3e9fc
SHA1 92811a50defdc95b225e8c1e78cd647324f631a7
SHA256 8ea9a18271c3090a13637ea034ef49bdf8060a6b9315368a2d56a493264fd86d
SHA512 41f395d1be454a09a9a75de27f35a71b909ed6ce298110199ceff26c726c553b966d6b3aad2d70fda586a4f1dd818fb201f92bd68eb7faa8c0d7698708be38b0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_GreenTea.gif

MD5 7cc0290ed2f54e196e0bc38705a68175
SHA1 dd786c8445b716acce9b61b0f79f2341d1783766
SHA256 3b4698b7d1a89badb7c3a876aed0f3312e92043c185d5f105b8e62814218fc6b
SHA512 92ee3de01fb804e4f6128755a3df739a0eb4dd782105efa6b63459c19f5a0197e8fef11c843521a797db5b031b687d61beb90d65ed7a7bf0e585ef29f19eb1dc

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_OliveGreen.gif

MD5 e6a9b3c09646e3013fb8d30cf6b89702
SHA1 0a1ea41e9499c11d663ad4897d598d387b699f92
SHA256 cfe0efa32e3300a3a2597f7a9a7265b1b2941096e226beea35082f578c9baa32
SHA512 48aad4dd451b1a63011feaf73472ee251ee58448380c342e25f155b0421f21f7159dd8113a8a8a0634a7920b99c75b4fe4ca2a132cee1b86b9173e3c1db0af7d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\BUTTON.GIF

MD5 200df5d5a32185b6e5ce981fe9b9443e
SHA1 52d488671a070cbab8715a25caeb5d694bf31314
SHA256 0ef7a6519d345d1e38fd2ec37187b7948977377a20e231381d505b6db4f11041
SHA512 17639476eb2029788143c0a24eae27ae7b2616a7f007343d9b053d384e26403d38d9c9585896f29c6eb4931979327f8461b6e02eee917f5391f060a0fc9e6649

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.ICO

MD5 70125d47ad9babfede4c298a17178192
SHA1 d408c28fe3dadebe409e0e410090b2deaf61208b
SHA256 58cae7054c8e230593295284ce34591d771228f25fe82cf2388de7badfd18f41
SHA512 10bd0e1afcff6d03d28c970efaf35830773621f8c7584521c4c0019e9e563b3a1c78e6c8a96e5ffc1bc0094dd88cef77f440847bd78083969bfb2e9d62b0200f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_VelvetRose.gif

MD5 2e5a43945904bfc0e608f23ed0b66445
SHA1 a69c2397b500ff091a8653b34096e7843082579c
SHA256 dfab0a00b484b775ab3ff23665a747aca5a11e521d4e5b9e5ee28729c72ac788
SHA512 d785f793ff305026db354207778c69d2168d532ca555ea3642927125360529007304026bb1c8023f9c880f8113a9e59fbd519afcc9a39888cea5bcf102706d59

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_TexturedBlue.gif

MD5 621e94553574b1e094bc3ad526669c16
SHA1 fbf792f4cb28eb5fe1d7e9de2851003266d5fed6
SHA256 76d727e0b6aefb511c1fc2775afee5516a7229556b4e8959e2526ac1345ef436
SHA512 1e3c1575c52dbfeb05a0958ee8950752535dcd1b1420a3bce196e971101b9b9df25243ab035e4a9a161df0131b62091724beba54ccf9dda4e213b0a2b57d8faa

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_SlateBlue.gif.infected

MD5 18a538450651f3af8e63e8fb3fe6342b
SHA1 9337d96f5c721f3b69c85780e30a353aed55cc30
SHA256 91c188f04e37746bceb7e553959acf23a7cdad0c1bd3f285171f640d65a2383b
SHA512 24725fac1aea3dc7250eefb7c9f2c516b44e92b3e9bbd51b6eef804ce45c69b6c3118343456bbaa1d8ac8962e661e24d34512c8c2c683175ae5e8d1ca96676f1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF

MD5 6b55335d4ac942a27df248ef87d5a63d
SHA1 397ec418e909e32e447af35ea412fdcbe0fc4fd4
SHA256 243010956d23576b5c58250796bc70ea37fa19f2a35bbc3ad1eb97fc2a432bda
SHA512 dcacace461d6eee3d19389013400bb192bcc6430852680d93ec81d11bcacca04faf368e8abc4885d22b0f1d16d8266189d52fdab375676530f3399987af63bba

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF

MD5 43588fbe38538b343932beaf86bcadfc
SHA1 c63dd9bcb8c2a67ecb448342f7faec3ff453edf0
SHA256 8c1af54b47ef0eca890d18847fd8ec680110ff3a0c3a5aff86b8c2988d768c0c
SHA512 6b44b5387dd2124f9fa4ac6e5f452385231a5f49b0cbb495a908271352f1ef67dc757b99cf089f703e257c098561d905e6aa78505ea84c4f2075d4eeb0fcd2a1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

MD5 c175b7d99e839ebd71a119bf10701f69
SHA1 b626180ba06f2249b609e19a50a57c9c26e22b0b
SHA256 264d0fdeeebbdace902803fd0fbc94f8bed79fd5c3acb3a184378ba784697174
SHA512 0fa9cd3edf4f7145692e8350544f4f093511c5172779be0855ec09f82fdeb3ad68bd1a1e3baae2a0b5009cd6868f7f5406b523e1d5257cbf88569b20a1c30dbc

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\VIEW.ICO

MD5 c56e51584c3462f7f1f5468e97a9d09d
SHA1 996937c6462c36b2b21c09376a33cd3e28c1b885
SHA256 34ffaad09243e4d34d1539c87d83e1b531a1299a25e97a96a71ab8c8e7df4954
SHA512 7c1a00f740c211b6042e6c02f70ef5166f5389ca34c8e43262aee2562aca42abae0ab4527f3c6c1c8cdf7beac584acd628ab8a7ceaaca76129318138402aabf4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

MD5 484ef33c433eb9f9f0a055d6093c93ca
SHA1 78b5ffd0f867cc048af5e0093afcf1292ced0ea1
SHA256 b1ce886f802ec608b0dc4c4b71d94b2e7c08a6b2b76fb239d6aedcfba015199e
SHA512 7f5583c5b2d7a84db75234ddad72abfd400bc1ae152fae37db594d227e3ba48cca2fe2b735b633fe5a72cd4830817187a19e791d98447ceeeb030840cab935e4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

MD5 f2553cfe6f0066924636f7c91b34d4bb
SHA1 58a8e0c28f0b88a07d2b672da3dfae589e2243c7
SHA256 a7bbdaaf8c47a76705c200257f65aded881656e1faa5b572b898f81978a7d903
SHA512 eb57451444122214e2dfb42fed2c885ad2434cbecc5b714df532de590e5c7ce06c407db551084bbba4a7827a7caaed2a1d98f24189c83244a650aa0ed25baf96

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

MD5 0577262c1fc488f430037d30d9b32f5d
SHA1 b7633f1931833a7ce77f28f6b013b1f37085fcf0
SHA256 19440656b972d012fde7070418a1afeaceea6b855f4e9406e0a412a6f2da7fce
SHA512 cf0145bf30b596bea108511d050af203b7ceeaf29860b82eac66fd6b9b346766454933fecbc366be5ac65891c00baf59f726b40d853c6171e58f809e6fc1dc9e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

MD5 d60903935a960825e8473051d93d1cfe
SHA1 597d15c13fef22ac957d3ee7ef1abc1b18c9f719
SHA256 e2937466511ac0b6afff7920757fdd1065e98d15e824d578784b0582cfe977c6
SHA512 0de7ddc89ccce25c96d7396fad79c688b6b6513b8078cbfefce4e7bd7b9278f0babd7a9f217688f62cb0d0d98500be6e0bed993108e791797fa635749d1cd2b7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF.infected

MD5 932d08e1d5554f59372fe03033444ce7
SHA1 b76d70a34dc9908f26c12000c4b6961fe6d094da
SHA256 3d08a6ad0432088442ee6da4ca8fa5dc4b9a1a256a7b3114a5f10196145f960a
SHA512 5e1a9e74c55ac60f84896d4a72097ca6e4c96732b1da056c88f8b13e1ad1df3b5b739d531f581198f90bc8074a9301f2d894a4174dd82b16f62d9122c816b16f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

MD5 9e02d9f77d72f4408122d3b7565e64c8
SHA1 659d7871b7de3cc5682c832e6ecce22b9d4cdd92
SHA256 fff0d1fbf8fa9397df634af311d6109151883ccaf1ec5d9b6ca156af6c6c3cc5
SHA512 17890f17eafacd4db480ea94bd3fe1a27c5f2aff871bb8120e844662b4c61e86181065978378dd64728b3f5e0071669b36bee11618e7469ce0550789b71880c4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

MD5 a2cca197b132f0ad8c404e9b7df44421
SHA1 406b64963debd7c8ac4c36f666d1622cf894d4c9
SHA256 4e0e2e625a893e4f2c8defed2abb24ceb100fc1c65298ab0b084e932e7c72e46
SHA512 308b103e0c1ac74d178ca06c72beb7e7023ef9daa8d9e92c9fb5de58d89c3cac06003327e8d00c24eab31f521d108aa6c4a36918ebd8f2f0e028d07016c220a6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

MD5 c015cfd33d98ae2cf05fe1cef6570147
SHA1 e34dac67d0335dfecf5da580579df688fd7bc2e3
SHA256 c4059b24b44aba5bc7578e382cd035c4dbccc015af6530ce3cf8ffd66c81533f
SHA512 e24e456139c635113f0d2416c4dfa26d1121a6fe950598d5b00dc4081fc58e3934c078cc628cf298debab9e192dbab0facecbf55f0f74e9ab9c8fbbd6148f42b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

MD5 aab9b8226834164c092c56beb868c26f
SHA1 083f8f826773ba784e5f497bf3f6ddec9571bf7a
SHA256 73f4a5d9740d52b7ae819496458d0e5c67abcc507da92f2a274a70a8b113eaa8
SHA512 2a898b74eccaabdf3e245e9eefadd1fdaca11d83e91fdd0e5af26472f34f82ac1743e9d914a39c8dc5c49a2bf29e18c20fa01d7b3fb6e3a41d9c4ba12a13c398

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

MD5 48768313b896609afce01db3221aed4b
SHA1 86a33c652f46547eb859b1d851a1ac18aa243de2
SHA256 49457caccbce475d521b49902cfddbe8b0da3c536a3ca7ae8e33fef68dc73deb
SHA512 17f8ce1791b11132c4bbc5cb43bac87722612a12ba9b966e804c8e8f3226e94e02f22b0c319d956cc420fa51bce7b96c2f70815d02bef4a44ec93fb4b45eef51

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

MD5 1b7861a902d5c937a8ad018b85a866c4
SHA1 b997cc6bf4da49c03d602851ef59a5c8e0bb7920
SHA256 aee762312893d4c12b52af1a23c09cea03ee4d60c41d53d3da7432ab0156370a
SHA512 9e612ed7f326fa7f8d7b8bdca46ab1a2377d58bcfafbf86c30ae98a864f36d71eb06b3924e2e2fe0e20614705c4cda7b7c0020a26b27aeb72798dea82a8c8139

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

MD5 80be93f1506853ef0fa2970711dc5f28
SHA1 8017d39a043d5c8d662e22877ea9e8b4df5c4271
SHA256 ac9acc39316145509abf167ccb8c7de7ea51e9de45fd6996dcbcfdf5369e9947
SHA512 c7c4d5ec85f5b25875933bc8d2c8054ba91bd4142837852afa45ce60e8463994419a70cb99d58d5aca857503d0b4a2826765fa3c08c24c9937cf1a39f388344c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

MD5 21caad14425b54ac620babef34dfcc0d
SHA1 b96d1107e482fe28903427c50c767f8ff8f44414
SHA256 20be8a4b68d3aedbd1cb74d46ff6e72508442ae576e53ec760be48c2763ff12b
SHA512 d635a2d25670b352aaf575eb1290aaf57605a04c3faf6310a9aec6f6de2be2434275787bea2b87f80811f95034ec8cb496bb2b657728534b9e902c53d2c31e57

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

MD5 c3df3aad912d5462d3b0b2234353cc94
SHA1 a983ad1edf8e30aa846da9ab974b6bc43e55edd7
SHA256 1bfe7de46c4800d2511a1c326bc79b3143064f99527cecb5d0b66cf353d28366
SHA512 39aea9facfe5ab605a3187f028ba21c4963b7740f01b82d08532b7db10285775173d8be06815c8dd7b7ba1abe0241d2a89eb9f28bc8d99c30b7c93da8b2fedb0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

MD5 19d2d4d5d9fcf40063df9df03895f060
SHA1 743b1f585d9be4d3d66a0c8e571005958c9177ea
SHA256 7ba1eb2d6a2db2e604c8a862ba7c689d65204143fcd5139b13edaa8333a124d1
SHA512 6a1d634fa615316a1f8cb7154dbe2dcf15ee7914595c99388356d6e9fde8dfdcc5e3dfa3e6056a5d2c81798db5805eb884307dad6d202f25533c376c57a417bb

C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml

MD5 45398502a9f6f2e556a81a3bc82eb455
SHA1 821760476930e00bf18fa0cb193d24b84ac70f6e
SHA256 34cae108778fb6183dd32ac5b031d11b380e2e5d66152a61c4c8f207b753b09f
SHA512 be7bbf27e814819d3107b8f2f56600213ba1d32ed1c024011b5c8c589c8654e61819c20c5a3ce77979b32605199abcc90c982fc3e0ff84d490c2a69392b99d60

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML

MD5 a545da3526707007d3730840d506b76c
SHA1 c43a3ceaab9ec15689eca1e4471d2dd208d1cea9
SHA256 813049e29b13b8a6361dbfd28307b7c5877abdea409dc3ba7642e1ae43a5ff3a
SHA512 7db9dc20a10057371325411ea40100826bdbe3a04cc6c91e551a7a888385e492b1fe3c9db60f52e367f7e2ef7e9c475c20982db3255bc894bea1ef1fbebc4122

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.HK.XML

MD5 72cc576856703d74aa18ba0c93ba73d2
SHA1 f00ca1121aed3d13706bcd416e694b8241aa4c20
SHA256 a3cc85e5c88892ac5390a5f47b573a97b76259d7a9fe680bc80a365566954028
SHA512 542a97b6c409096ad61255f25b22e7cd454d14795bb35bf4cfb550319717dde013852d39c65ba2ad8f068f83c319a61a7411f07a93dddd23379af196992f99b1

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck

MD5 93ecbab5a2523013fdb4819bcdd174f6
SHA1 596e3144038a5f6832ee587ba0da521563a265be
SHA256 a51aa0f6355d42834f0fe103fddeca1cfafe7f95d26907f374db22cba2b22691
SHA512 bafba19cb2d3034faa2614402c6767eb15b2ceb56b40673916b2cd8456d8c9c1f0e18853b3c88f1d124e02ca337dda4ae052ee9b00ac89d4b63c08823de03f47

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.002

MD5 5a28212e9d4258ff3152b764489750ce
SHA1 47915e45ea83d799bedaef4a82b84b9786e807a3
SHA256 b8a6a46f2450fdf5507adcd8f824a6e48cb3572af6d4875e2d12dfbbf8e2a88a
SHA512 8d56b93a6d53e48d94daf09c94221627db5986673965ab29e0a0284cedcc3c55623f0fa1c221f4b6d1ed573cc049d745606df6f22b53574056b71acd87f52e5e

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAD0001.000

MD5 cc5ff589ad145ccc8c3a74a787c60063
SHA1 17871d6503985cffca80d59fd4307bc03b57a9cf
SHA256 2bf6af86a4035bf1c1449324b748220610f45b1a76d15c8fa361d31a819414a3
SHA512 96bfcf8cfd663e2e9ceb62d33bc689a64302745c48b11514e38c5c779129b87d9e7edfb1a933b43924b182adb36401f140eed16333102df22cc165191f2b99fc

C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi

MD5 f46eacdb9fbb810bb490a31b10e5e325
SHA1 3c7c76af6e921adb89de691f1fb3192451a28fd2
SHA256 bc631e69d3566247bc53628941f968b157ddb92ef975ead84f493e0d3952b1b8
SHA512 475285625dd583a40e163dcab5a7282681c7d9db675dbc8d95b8db2b53718845d6fb4f944d3decc9938550124c74156509370b5f2d4953ded4376ebe70cf3240

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-27 17:40

Reported

2024-02-27 17:43

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

132s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 716 created 3444 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (6544) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes system backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe\"" C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe\"" C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppUpdate.svg C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_ellipses_selected-hover.svg C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\VideoLAN\VLC\skins\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-150_contrast-white.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\example_icons2x.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxNano.winmd C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\Json\Person-Content.json C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\selector.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\20.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\WebviewOffline.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_signed_out.svg C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nb-no\ui-strings.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\msapp-error.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.boot.tree.dat C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-30_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\adobe_spinner.gif C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-20_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsSplashScreen.scale-100.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTile.xml C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Assets\AppSplashScreen.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-96_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\de-de\ui-strings.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSplashScreen.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-100.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-256_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-48.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.NetworkTroubleshooter.winmd C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoFrameExtractor\UserControls\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSUIGHUR.TTF C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookSmallTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\main.css C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionLargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl C:\Windows\system32\wbadmin.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-566096764-1992588923-1249862864-1000\{A2A1E339-DC12-4EEB-869B-66F87511EF61} C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\explorer.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 716 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 216 wrote to memory of 3948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 216 wrote to memory of 3948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 716 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 4700 wrote to memory of 2284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4700 wrote to memory of 2284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2284 wrote to memory of 3136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2284 wrote to memory of 3136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 716 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2500 wrote to memory of 4568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2500 wrote to memory of 4568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4568 wrote to memory of 2480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4568 wrote to memory of 2480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 716 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 1372 wrote to memory of 224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1372 wrote to memory of 224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 224 wrote to memory of 4976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 224 wrote to memory of 4976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 716 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 4680 wrote to memory of 1892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4680 wrote to memory of 1892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1892 wrote to memory of 3204 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1892 wrote to memory of 3204 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 716 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 1204 wrote to memory of 4996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1204 wrote to memory of 4996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4996 wrote to memory of 2888 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4996 wrote to memory of 2888 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 716 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 4644 wrote to memory of 1016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 1016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1016 wrote to memory of 3432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1016 wrote to memory of 3432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 716 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 3556 wrote to memory of 4196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3556 wrote to memory of 4196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4196 wrote to memory of 1384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4196 wrote to memory of 1384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 716 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 1848 wrote to memory of 2840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1848 wrote to memory of 2840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 2416 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2840 wrote to memory of 2416 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 716 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe

"C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill \"SQL\"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill \"SQL\"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe

\\?\C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe -network

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\explorer.exe

explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 202.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 167.109.18.2.in-addr.arpa udp
US 8.8.8.8:53 114.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 178.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

C:\odt\HOW_TO_BACK_FILES.html

MD5 a8514fd9f3a52ab2a00f57494d03b2fe
SHA1 0e204aabbd8b5d6ee1b36d10429d65eb436afd14
SHA256 056ae301d1686bbf2355fd96ef3363e2b18d593f58f912498d87de3569fa9028
SHA512 6250481712b51d19e13bf148e3cb046fbf669398b06f8ce757a8583a0fec36ca22140cb90d4706a731f27d1419795ff37ec079d170e15e9e2985020c1e6a1d5b

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 40a708fbf83958ba52754165660456dc
SHA1 d3e039f525eea3a7215269a2cd90690c96083368
SHA256 02f86d044efb64d0b6cf8f7280a6a84d1ca3d9901b1d8991ec72796ecc9201f5
SHA512 df73305a932df35aacf4fde4e71031762b3c451dd18ec1c1ae76df3699d41457d98d66d9f8697b42a396cb5d8e8c264dfaf7cf5cd4319aa96367b071c96a64b1

C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 374f70c30d64a4ceaea01333f1482996
SHA1 4016418009e0608478666b193081bf7673ce02fc
SHA256 de773103abd0fc1f4d8dd83af6bd79cf4f2d6434c81c47bf06fb6fa74d641d1f
SHA512 7ad119f2cfd20b2a0687627a4df6b712f7516c9bb54166c264a3d98b1992a16dec4e8bd4cdb04ee1a5bfb1c26719ebcace390f3074df23624ace57bfbc597d56

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 db1d370acf747a25c0696e8ce1a11496
SHA1 d1048760cefb1fb22f4a7c5894f99e94b2c13078
SHA256 0b0a821f748eedd5de7e81f8e1435c8355512506d77948530cf9ed4c49f0557b
SHA512 f48ee9e86bce6c11991d0ecdff08c602b072179afad03559764d78bc73adf0520ee06da0a06d8afdc6467cec28ffeb4bbdf1e2cee59b37e45a67903063e1d38a

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK

MD5 c9c99b04a72cd23a71b29cb05b779a8c
SHA1 2a34cae0503e8c46e4eca59a7d781e27a97f9327
SHA256 12d851d7ae47b47ea0feba6c2f0a9be2a603dc8d3323da2417a43e6e987eae11
SHA512 5d79f7feead07b6c9aa560ccb0c2cdc6c64eabf7bfa8272e5c58c0f851e5ffff8647749980be00008c6c4efc61104327544ad17494c0ebe2edabce5c603da354

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK

MD5 086c8e411bc5ebc7a43d21caa0d023b2
SHA1 1588ee5c49d174240e61ec890575fac7a0a7bc68
SHA256 95494786e7cb0ba08f1af4665fdfa39d300d98624e70f49e025d8b34ac20b8de
SHA512 a9599ddee0075715a97d1766bc2ff1ae44155f6ef6822672a3ab9c84aeb8024d92c4c2ee99cd2fbc06668bb721fdd75181a4c11ec82f6385f9e18b4dc09e5a96

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.infected

MD5 8eca7afdf5d4e0dea2a7eca842d7e9e4
SHA1 deaf7ad0e23f5b9870afed96dc7ebc8edc1cda66
SHA256 315071a53a0ca5a1bc8a1a06b0294b6c0152bb943f7b522bf3c140a690de226a
SHA512 7e6a6a64f5008658770c24e841eab656a65d6fa8fb64e788ff8519e246f4484621215aa4b7fddefcad66c6ac20f913a280a7c1bb43ae0b336cb9c484dbe8cf46

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL

MD5 ba293fe1bd749620126c362f56432885
SHA1 8fd9c497eb1a2b534daa876a9c741d9061396ced
SHA256 789bcd58f7d57858455bdb0ccea3dc11f91ad45472bff8628b82c11e8f27e228
SHA512 b8f33fce5db5bfc90bd0e3638d10f54ee3cf92b776ff0e81b229937b9d90198d2fd7aedea02e974dbb1bad3889ae1a896191dccbf91e1a0d8667da5af2816ec7

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmdp64.msi

MD5 61d7810cadfb6d20a8d157fde55347be
SHA1 552634121423c40add6c02411d703cc2294dfe13
SHA256 fe03cf09e33c81236785bc0c215fed1c40f55ee4cf4ce5a2387e84d92598f89b
SHA512 13c63e556667ec62727c660313230ba510a9679c236941363e9f6551035eb92336f7cb64861f7cb816ecbd33179b7d51bc0cf6691092188f4f99c166d43dff3e

C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo

MD5 0e6d8ff4c4a669c09d07191d19379aab
SHA1 947a1011d793415f346a7303f67ffb64b4523bcf
SHA256 9be6e652ace277c5a5c2030cf5820762ddc46c9fa709640eba9b2d2b7154d818
SHA512 024e7cb9eba592f0c7311388301f8edd181a8f68721333786adc5ecfd8bb5e37c6d4b55f87306d6ab34b2a639eb181136bd6c36f20e72beb6a781175f6390b3e

C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo

MD5 dfddf681d6e23c1565e91657371bf209
SHA1 a1ba6caa700144fdfc87b4d391c760d9b72fc58d
SHA256 67a359f306344f44b75e25d1bc5c27a61eeb825aaef1b76441964487c9e4ca9f
SHA512 5196f8c026e7eea15c8b80349f12c8abc87a8652167fa79141713c588bfe9714302c0a1ad243040cbf496f839b92b3d6a0cfbcbd64b46f4029ad03d681078f9d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_100_percent.pak.infected

MD5 e3c0ee0b416b47861f1d897f78529038
SHA1 e8f28e1e201889082b6544afc2a1c0bd4ca21b57
SHA256 aa6c19b1536e60bf2decda7d837a0d1c8468e47f0d280ccf43e98d61ce07e7d0
SHA512 49150ef705c8a480a65008ab4bb5c877ca2bd91f29921ce5e8f71dc3127d0a68ddced9677447e6e3a111626de33e3d62c6bef75bf03522f9904919c32ee50e89

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 ba8e9ee3e349006271834f6eaddd469d
SHA1 437a02e6ca1fd79b2f141ee27e6e091b52d0799a
SHA256 cb774c38fa1dea13c50c14c4ed69b21e47f4e3a27519f2dfd8d73b9948db492d
SHA512 fac43593c32cb72f01d0fe5de45da243a3977f21e6af3e58652d66eddae390f7a407fb678777a287fd9a75d6c11d80cb4ccfaf2b98d9ff01522113daf35cff38

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 a6348f46d9a31d66bed8af1a50376bcc
SHA1 4eafd590f30f5ffd99ab5d9e4335194de8344ab4
SHA256 f317004693b89d0864d42a5f94424e501f6c2e5660e93a51776da47a9a4726e6
SHA512 cb6fffc816447f554f4226d7ff80efe60483f9463e7ea78c2ca7cee45ea1e2a8f1e4a00e95a98259c9b45b75535d3faa6b4140a845bbb6898a0148cd351c9c1a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png

MD5 3e67f55f5ac67566f63df8c586e4e9ec
SHA1 5c1f3a68443f760b5ee323fbe9f4ee247549f8b2
SHA256 7c9101ef6b91c3f92d6a92ecd616fa1c796ca5c20a4ed417e9f450072b4e792e
SHA512 9f703aa70df641f70f7c4da192f2cf8e67370d531cac23ea17097cd31ce08599f2653a48f1dd1081de273b14132b968217560945f2f8da0cd4987e55bbeb4649

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg

MD5 6b073c2b5b6e653d0d3feb7d6effe3be
SHA1 a68f5b66b6a4a39603c0ced2848d7dc8bff09a48
SHA256 a5c70e0348a91671fae1d7a9cb1858d711d42564ca24f74a600ad2f009e413b3
SHA512 084d009e1d06f1cabd0b7dbea92767d2829d7cb84c674ef1f5bbc55f0bdcf9242f9b4f03ab4f5fa612a4409db4ba832ddb8fe8b9a78b2321e7b7efec32e4daaf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\duplicate.svg

MD5 2b409c67899e8037175a4d2252f1c99e
SHA1 b888aed2622c2403a3efb0c90f7da96ec6700490
SHA256 b36d795904bd57ecb4e7786a96fd70c8814cc0bc5b3b4d8240a7f82560a241ff
SHA512 1aa29b1ac199c3f615de437d4eda7633f72c6ef47404d857137960047f5552804752c69b698c322b0cfe2fe22a5f7adb2b21ad718328d7c000a1995f9e3ed351

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg

MD5 0d06a81adacb4dc7eb96e33a6328b4da
SHA1 db35602426d3a15411d3c2ab1af80fc4b04bdb42
SHA256 559d8890e7fb4b4bed36f8481a5f8096b98a6897ed86eee5e72ad939131c3102
SHA512 58ad80b23022b3c63358c4f7d5b80695fed45721be6984291c32eab6e1dc671df0bfd5ee3e36e7d39a4e5e784cc0936c79f6750598760794c9214477a0954a45

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_backarrow_default.svg

MD5 8d4d7f6b79bb38313e1b8db5d21ef6fc
SHA1 8a08ae0c3c3d8b89b00309b6ee9a4cfa9698a223
SHA256 ea035d2f3c0137457ea37afcbcf2ac8a1c8ffd71ebfbb82cf62f69161853baeb
SHA512 3cba42557b73837084ea9b2745be7436362126e439036f56d1f4940ccbb43100b025737eabb208e5e5110a9397a3e67982f9e5ba90d8999d7e2a21b845788ba0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_fillandsign_18.svg

MD5 b3fa5c64adad4e305018c52855842a6c
SHA1 989d9ab85a2742a20429b98186214299fae584ea
SHA256 910f3d6fbd1799227996632c09a50e43614d99d08e34ab9cef5bbca3f16344ff
SHA512 3c8d508fe00e85b198648f5960b361d4c24117f576a3111cb398a7b67751fd9f55ecd7c30df81b3a2707dba873c02d68eb68dbbf0b95aa7a25cfe9d6af869cc5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_export_18.svg

MD5 e7c12802cd9fd4bc2fed350d4cae5c7b
SHA1 314bb2e214168d79f3078246836cd463873cbd0b
SHA256 0de3b0a632c9384fff81bcb3e71197d2acd46d28a63e07d771cba2287b849a00
SHA512 b976e217482f20ffc004641db67a0ff6f306ceb17c9612048b39545b7eff624fc7857c82e308340b13ca21b9dab79ce50f1e0fb650f6a2c32dffae4edf6df449

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_editpdf_18.svg

MD5 59857f910ec7e87b3ae89ff9f9dd4b52
SHA1 db558f7e1c39e179a17cad140bdc8d00873b1904
SHA256 8624dfd8bcae8ba913d73a4de84ac116198cfa985379063dc7370d53f3ab392d
SHA512 2160c8429c25a57593152c929d13254ac3759f98eb77adf2214663a3d4b6407123e93d1f20e5a73cb4d84345dc362b97531bd4bb062f385aa28dea06a378d2f2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_comment_18.svg

MD5 16aa88158b91d946ef75660b2a93721d
SHA1 191ac078f2daee5cf16bab19c538e1294b516005
SHA256 bbb825f7ed13022dae20fcf24edee622174a6b77122bc6db2cd8e85a26701646
SHA512 d86ef5e3587232ae7ec11e6de3774be7c2aed5af76b464e2947d132154a1b0bd79eab7bba24ce14d55b0aa16b34ce67d88d2c9191f215cd242294c9e97f080c0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-default_32.svg

MD5 9d9b65d5bb5072c854e03e7c3876d50c
SHA1 f331f561293acaf73b9381b627d8d79b526623ff
SHA256 a3e6a9472202588c8622a46ff7942c87815fa3e601331f0f5ad6d32659b46378
SHA512 f3d48058465969aaf957fb7a7deb8da35bfab9aa71f432c01db3f760f28abddc2f1e6054295e27d7045ae811bb222164230a99ec840747d29d78628f1e1d7cf4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_rename_18.svg

MD5 dad2fae7813a5bc5309d818c018e7f28
SHA1 364ef4ebe97a49bc2e8c31f3911b2590ba667cdd
SHA256 4daf1c4ac3db5a87a2afe0788dca9094212fa63e9cd674be87905ba9b86c6227
SHA512 e6ff965ad8a24596e713ef71bf280376d91f469901f58f488f6c917b9938a541d6a5ff3349e84ec3d927583a5ef2438c3dd9aabdae4b7c6f7ead1f4646e47247

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforsignature_18.svg

MD5 f1f873a344a44cf7e1678c1c00953acc
SHA1 fdb35784bae4614b052809ebbea732e3c6c70f6d
SHA256 d52340abae1e8939957f000d7da211e93840cf0b4988d03062885d4d2b49825d
SHA512 31c6da39915d44a2d15b3ee2b60064fcf811afce93272d7123358507eb99955581af185b4b46f663b072b93be84fc7251c91d5c8a1c0f2a1ea17c93bc20de527

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_share_18.svg

MD5 e0d9aa07b3d5ba40ad2df4c896d8c978
SHA1 9a5c88795389c16dc6f9a4bb695b66cfd65c427a
SHA256 d7153a528ba73f08d0140f8cb0e646f98e4b117fa02a23d5dec421d0076b65f5
SHA512 484704193f3432a6515d7af3bd2540881e25ab3bc11ff982c4ea2895db7e5a6911a967b909aa1de12f2e9f94c3790fe0a16a79d15c205f0a95fd1ab449d8d58b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_organize_18.svg

MD5 154369a59fe75702fe1366bf1e495723
SHA1 0e2ffdd4771555454323cdd0954eeabda77ac040
SHA256 a8676b62e4c547484f42823006aed2752e4a03b20c0d557f0f7facc22a3e68de
SHA512 97b1f5236df2fb1b7d04dee44901551da598d58986cb6b86e5dc2222cbb4c41d6f9994fdaf9ee83cadedb021a33fe6ab945d0a9ecdad3549a0fd2c5311fe2fee

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nextarrow_default.svg

MD5 f80caccc5f542ab8191feba7f79103f1
SHA1 d2680db06ac4c9e437e9e74bbbfba9270b8d8510
SHA256 55b59e6422455d81828b810880499cab33c98b53133c98007493cb0b830da25a
SHA512 3d4c05578fba919df474753c6f17889c6e6d645623b40fc1c925bb7a4daeab6b8cd970391cbbef225fcaa270a77c51f157f217c55fd78dea29c7396737e0f127

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_move_18.svg

MD5 dfd75985c8ee712af64354ad831b2d41
SHA1 d698c09fc6d12a4eac83fcfb00b5e9706f30e042
SHA256 6c709663a76fa50f4d50b8804408ddfdf089944111868aa6e57487e380ac0689
SHA512 050c4842c8c80b28d2fcd504efbbb5c1023cb7ec4fa36970c896594373d17751bbe637bb3607cdbb2749fae70d3b7de2ceb23961bc2fd3afe1c6a2eb4b282828

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js

MD5 67bbdc4aac9a4e8b097c13fe28f47c50
SHA1 9bfd69faf14d6a11bdb7c631682ed082a538954a
SHA256 d9c8298b0ad12271cd5b51cf9f51671f331f0fb64d512eb54676325a980d6fc7
SHA512 a221bc9ed04acd7f30014b84d98feb5bf08ab2d33cecd22db096b9f986272b290c866c04b225aaf37eb0402809280d06576427891e605ff42ef6efb47bdbe2fb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js

MD5 741438a4e08542d7189a0cfa40d1af23
SHA1 aeb703b759c40759be674f6c3c2412b056feda85
SHA256 228365e2cef46cf5abc19080dee51e6590f6e03456b0e9b20dd00e289a7ce8eb
SHA512 32f349bc3249c0639275680279ea516d2731ddcd7ea39efb2afd7e6b95f2746a0f5d2d8f818538ca635fd424f526c449ee484a752230848906f4cfbed9070c5e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js

MD5 12149efe5b1d55dc2c5ed720bfc6e2ba
SHA1 1101f9af03e9ac0e5ccdec7f33d846e773cbe6f0
SHA256 28e363aaec8d4891e1c7150ba2e0ad4664e3d85f2ffe69b845cb8eef29d6ac5f
SHA512 2c55e598d5ee849a229c46a919578ba439b6c9e38c654e41433429254aeec3fb00a3ef8d9ecb57e20ee4893f3c8d406ebf60cc826e7ca3204441bb0af984f79b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js

MD5 fbae2f709aaadeb01c2129a65447fe05
SHA1 bfc17c55ac1e8aed56672143ce94af63657820db
SHA256 a49479fa5bd1f9634e88053f8dc0dd4ed982d1480ced627d487b8b23cfd3a2dc
SHA512 73d3f6a90c69c2264eb09332d81254204fa50f90fad50d39b6f8cb24d64a3fb53a272276dae198982ae1547751f5731b26a779f14c493ca9bc807c5f431ef0fa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js

MD5 2429b60ca300830c0f08f41d00de7550
SHA1 d358ae5d533aaae26c902e9c0cf28af31a36fb35
SHA256 05479ee898652cc9a6a0264d83231341852315ef89648ccfba1282bd6815c923
SHA512 b1136f9657b3b342ce0e344e82dffb1d10136bf0efe9321fa5248e0a45729be47f87573d67a5eef32425a19315025cf637a216208bc30fc5152916ff19b2c60e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js

MD5 c7eb08df2aa2d05a5a0181dcb68b99bd
SHA1 f0a81a8c8e8106cef1c2bf3d724488d99366abe3
SHA256 d43bdbaa19928580b793400631d79b882c0db3cedbc382007a8323121dd44c12
SHA512 b415cf08094cbdb560c59c99587dff287c198ffab5db8e879d36743e1438d6020d50fce865df92ac5d6d457d7b44bbf047a9eb69f3b21b30cd81a0271effa1d6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js

MD5 9dce51463051c42cbfe0ae2b01deebae
SHA1 629218abe22ad0b5323846c47f6c877c6407d299
SHA256 2939de7f2939b37da3ed1670c906386cc3894ce1f18011a1696a1dc29c3b4ca0
SHA512 8e7bfdd2332a1a5657e67ded7a524175c257bc451248f21e18ca6994369e30cb09cedc545f377eeba236be0c450213fe0fe4f0557fda4563203547e964a48778

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js

MD5 f4aefec6e6d4d177acdf15d6a3e5f1a1
SHA1 33c7ec597bb9ab02e1998c8fdecf1970043fc9e2
SHA256 033920d61caec0c1b7c430a865132b9c7732e32580b9c95e470a7b63eadcde16
SHA512 6d5ac5adc55560447f56cb352f1cec819d02e49f9395abdbc318e9966f521070d447724a953dc21325348f504358c1f51ad6523abb76651890eba3bdb35cdc15

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 a20f7412aa21f9f72eab123ce9ffcf44
SHA1 24d9083c68b3b696f00c22da637d29cbc3ca63aa
SHA256 694a55f195fa8f78f4473fcbcbd3ea27b3630a15770bbc2442a974825b805651
SHA512 746e25820705b87ce518100f5aa5a5d7296aff5c4a890ef06e17b5cc672a7f1961ea0105301263323557914356835546bd201482a72326b5effc8d8d1a970a39

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 a080027981ed3f565d75302875ac8b1c
SHA1 638d7af6fe856d8bd36459bd11f79bd3bb779fb3
SHA256 78f7d01a8b7fa6268f0085735a8a9b4c917e1bc9c82440930e49edea7ccb5483
SHA512 01de3d254f9c5c854c8e644f6d1233fc9be30f6a8588b0a6ecb7822a177a6e47951206a2c9912730eadbfd2983ba30e0bf46d41b17c4659825be30e461118cd6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 b2502f9fd4c7ff1d1ddbac3b7a273079
SHA1 7f06c85dbcdaa1389cc633e9d7d35b638669c146
SHA256 b3e1450bc5801f4f0b70832790a889d7e1f7ce41253f04e32adae569464f818b
SHA512 8914170e7708886f5eecec86cf7690cffea9d1aea740abf9b293717a5135d72959a80c2af9f27e2a62c8d1df992b070a6aad42be1865baf1e59059089bf2a7d3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 404620e35dedbcc7a2918e275bcebad2
SHA1 93dd3a8508cca8f834a20bcd3bb395c3ad8f55b1
SHA256 2b5c3a2da862fc4253fac25822d170762ace28ba5278a206dc8d56ac9d6c6080
SHA512 57215a278fc6c3f6ffdaaadd5d95b7d03f9e43acb3a95b01fda82ddf59ac362a2edad18392260d2b694fd21049130436ee69baaf132adf48c4f89b55bae85164

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 ec429d2bb8c37e7d598b67d443b56d47
SHA1 d4827a9236d863ac7e76fba550e43f987747461b
SHA256 ffbdee2f21180c222213365d934277645d8f0a1ddc448ebbe1bfd8bd668d6790
SHA512 ac93feb2906fd82740fcee58eb390f333226c1acd271e91457b0c53db1407acc6006556acc180203bda0ef9e42067bcc5eb1fe4973a3f65bab104e1fde22f4d6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5 a3d574f6ad96178d738b4dddc93c6455
SHA1 1b8dd64111c061071a51f143328aabdd5efc9b7c
SHA256 b6cbfdce00f8fea2f2ea8ebdff95ab65354d52c3daf5c7567013ce0e2c29b02e
SHA512 e5088268d84e467f08195691a046645e7716a9812f90801461026c553a45fe88d60caf8cc8e014488c0a63d6c80fd1c8bc4be301cc3cfa04aafed2b7c29c7cbd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 bd28736f700111614aab61fefb865022
SHA1 d10ad0b112c0be5b5f11579e059db09315e26dd4
SHA256 12659b1402aa04b4d0b9ec9427923d26b356fb701f40562ea8a1d17784bacde1
SHA512 b30045dd2f9a192a2bc2bc92f517d57ed1b0bad19bcc94794b879473c6870744e2ca3da33a89c975e630c2094e0ed5d06914273127635f7e8a2d459cc1e50c74

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 495c87860df38b7f1cd99758e5421254
SHA1 5eee72a4e569daa3c4574299fa60e61f0c2f893c
SHA256 24e303aaca2e1b2f89f81dccc20e54af7107d5042277b733ed3183fd558599c5
SHA512 91533ac237728d5008973126b5f972c5086884ac6f523ee18e2592726e4df36789b8f6f662211eb611a65ba483595c3b27d95d3815aeee8178668f83856bcbcd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 15b279b47b1e05f6980e1a18792a445f
SHA1 463a0c0b54c4cf54378e7b07d1eab3bfe429c9ca
SHA256 f4e8cf41518d7a164dd46d75554665cc181e359e3541a5c6fd4c2487d83dc0fb
SHA512 0a92aa489f3895fef232e227f5364fbfa03b1ddb9b65f4a0e186862a1360e16c64785b74c1ca5728f636303bee50bd95e2cd4c134553afa3bc060766e1cdca2d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5 e9500136d9e21d56d9b8ecee0b8a806d
SHA1 54e8d963e90832f8fb6b912db324119e536486a8
SHA256 6f2e7b2218d3840a9586d43bb94aa4765ee196978a0567b2dc521685b13df983
SHA512 e0672da4cd9982b1d4c8e51f56a72166155007664d1d14097ef72a5b431264a383ed9f894930ec28416dcc5a0d119a67c422bf00b501a84188309ae87f4ea453

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\ui-strings.js

MD5 a43b2c27a29923184d2dd2ed190cb4d3
SHA1 4a8641ceb1e3c4809d2f7a4c8c2d986ac41c3f1c
SHA256 d19a784d12760c3ffeff55f3d19449a04243c33e3f4e1583f80845b4353c4b7a
SHA512 631175e08310c281f0bce8e7f4249d8d3e7ef00a99eff6af2b5c4f299e437d226040eaa5e3de8000e0afdff80d811bcf25f0694a5cb653b98ca0310cc9847ff8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js

MD5 278a3136ad2334ace5b16f43874077c1
SHA1 8f1ebe164d1060d132915ebe5fb55cd066c7fa33
SHA256 cf267d691a054b6353ceb9cab2ee889a13ab9143990ff1f3be8bafc504d445a1
SHA512 0f4324eced2e7827c3ced9310fb4d3b57baa0bd0f67c8e45fccce3bd362de977a86aba28797ea4371ae5862ed670ca77942066b744f39a865a0e15c88635ba4e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js

MD5 3cf16c902d0e7200d61e289f20f51967
SHA1 785fd61641463b5b0a4e0353ac43f8c0870af21d
SHA256 9a5598792f8d045e2ad73f11e7fbd4279cc9b0a06a81af257dbd252e46eeb9f1
SHA512 5d699a9f03e52611e39f88aff3cac98822a3305af4062e13cb2fbf0c9e7f0d0631c1732a031f9f56c4af2e7c68e86c8b4abcf3fba0d6e1ccc9dc3f90da5bafe0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js

MD5 5a2ab0ce0061cf0525325cb4c160366c
SHA1 42ee7aaccea13880e32db86eb719146b10b0f4f0
SHA256 89e1b9cb5d28ba0d1ea2f9e4e03cac4050c70928b1f2b1a6d773161b46973822
SHA512 5181b39ce8185b503b1fe95d38315856835334733a1a308a94ab9b3f3e3dd9e0adfe884ec8e84218888a9839ddcd16e83413805499d33ebd8bef16292df55c06

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 aea38265465727fe4015d2de3bba4e3f
SHA1 86a01c24d777bc0d5211f8fdceb8b904ce3b6248
SHA256 35e34aadacc97e92322487379ac2680cf09149ed6f97020f5ec5d75ab2a90fcf
SHA512 d1ec37884b54ff27f7c2ef19e4e50b862a902e0eefcc7f58ce674ba2ff7929dece452f6487659f402e974f96b05a2753ab9edba0a70e5000c3b1bea42b7be41a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_retina.png

MD5 6278dc084c193020b4535648d4073115
SHA1 70735e64a4e4aa9b0cee7848ee0a6ae28c844df9
SHA256 834cac3ba7c1ac2441427d3d23cb1180a150223caf1a28a2e148893bdadf821d
SHA512 f00cd3784b72f6b1c4ab8cef7a2359d5076dca2f4055df6a7a987098829dc3b4cea6e102d3d0d37aef1cd206c484549447f8d7f383de47ce6dec76eb6f0698a3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png

MD5 5d705512ce6fe792189c79eddd0c01c6
SHA1 8c70f020545aa66f314876ec497fa9e5d88f6b0f
SHA256 fc2bb45bed7d2604a91cd664d3601394e829110bc2704947f2379193236518ce
SHA512 861e2e4c8918fb46dd3ef6d031dc4f4e2fe9d0eb001df353ae9d2be7a6eb426e757e201c1f0a8e4bd86b96f180a7c945101fef32a95ee672d0a04190558f0c66

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png

MD5 6aa380b95d2b9d6ddcd64c49b1ca99ec
SHA1 986bdbb3cd6d3e032302f9179740c621605e4725
SHA256 002a45e772989a9872b5fa939326c140816af4d8da4dea25a939b95ed09350c4
SHA512 a86f1d7515c951506ab55a6f0997f873310dbb151936c9f8c74ae9298b3a05d576c233b106c1c11c6f757d2d5d7eb92e0aa0170bfc2e4970830cd3418437db4a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif

MD5 8a74ccffc3797b660c143341958f70b9
SHA1 2b99c602f3a118a134146c1609fc2cf25a908dfa
SHA256 663c73376c1e90ebaeab874e763bfe794b61faefa6cfb4de87aa337b44782ffc
SHA512 5fa1e8cee799687e6c41e4b8020161dd379f1867e47ae2ddb24e39dfc59c607362b20d19abecad644d6e698fd607623e55eb4be14fb73009163a89d736554243

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png

MD5 eeefb920d10087314f4d195cd6a71794
SHA1 ff7f754c4d88a472c133ce120c985ad7ec16c144
SHA256 3064c5eaea5ebb0ca9f56d1bca887c8bed7bc989ff118f927c265232a0233951
SHA512 f89d8f25541bdec17235d84038662752336c558195c6e9d47a52e2fe0de5e62043fd3154ba7792ea4a3f79da790c8ae8e1ca7dde351b10a1a0c599289cb22621

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js

MD5 2c0fa3a576907df04471e0c0a6d6c413
SHA1 94d5f98391b85a7deea0ade4dfc560cf27a8f30b
SHA256 8903bbcd1be756ee32fe785382a212b743979353d860e40a3cca0f885af54e36
SHA512 96b00de4a24c9c96fc22fea6ab0e1a8bf577239a50e909e6ab07d04d7d01ac74a04d13a3f6c59f0c16235109cac9e1dd3673176d62f8d6421d741fa49b9fbbdf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js

MD5 482afe65fda008365563bc0afc4405e4
SHA1 6321136259f1f57b44eec6b32ad5ef2beda78e91
SHA256 9815a56110d0af3d9e3568a240406cb9940c46df87aed91a454a7cc25adc4ec9
SHA512 57f1740a7025f1a7cce4aacf84c53689ebcc7b6be806cec6330916a30298a9aafcc38261966c07b6627dae354e5d7d628502f9a4ff1a6747379157ad8f7a3a18

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js

MD5 493ef88e2c94c8489de97e56f02a2ba3
SHA1 c18fc567b2f43e713758ca456db82d471040f0af
SHA256 a216721bf2e059b79634bed0366dbf00184ee866a99c2c62a2240df5cdbc536f
SHA512 0c523f6555d8ad5d3ffce87b0ed70f71f33ca6d8c6be05f7f50b98dde4f8f6904c2990e04958643019de4984bbd8466cc1072527b0de7690a8a04867855bbcd0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png

MD5 ae50ed57e9aab93a4bad62ba114c9bc2
SHA1 50029990a1da2496a2e4cf54b64e48b3ec4ddf0d
SHA256 7343ba0b07caa66e1cb355d578f3d064b6ede50d6dc5554dd8abf7a7cef26f92
SHA512 14ad794d29f4321e35963c08ab9306d7c494b6fa8849303dd74c66c0ded2740e784dd748e69524e5b0296c7275938d9a4ab5a13a46427d650b000a81c58283f8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png

MD5 165f78e2006686f60f2ebcbf2ecad85b
SHA1 c8a4a69547bd9e36f4924662253e8b18d61351f1
SHA256 49d6b3562f54f2d4a42fe2a4547aab0eca0e27f80cd33abbf6333c88d2c1ae00
SHA512 87a4ba24282996d203c639717184478814107b12a295019b47e0a679fa0c84c765c83172b34d18fd3b24501a1b40fcd72aeace91db31927e7785e47be0e3153b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png

MD5 322403454d0b22fc1552a6b6cc1b337c
SHA1 8269e7c685427654f98ad5f068e642bd1b79829e
SHA256 50319427924311e086030c09020204e8c738850580b0af51607924570cd7306d
SHA512 333d277ace950aedc9ea4ea559ad6bc0932d6eb83718b1d31be3e47045942212ea9a7028aece249f8869d2d8a310da6667c1c6035fea7c80b2148473d29c7390

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png

MD5 828dd2021d1d98b5b26c07f1f205ac8b
SHA1 941963c9315fc5a1812582a36c41800714523d3a
SHA256 98f82e5620607fbcac37a689b0a0d8aa97fa64698bb498e067ce5c7c17b7e058
SHA512 668a185ef44d8b13bebbca9d8e199497d70e5614eab60dee626bcb86a666b222e06ebdefde90d397c5247b9e92385bdaa66ca1e85cded7a22b0f63f063ead21c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css

MD5 a826547b12fd2fb4ac708ee9cca00726
SHA1 d46ae0ee863006cd33ed42339dce79db74a6c3d4
SHA256 4149425bb343de2ff8f1bd53f2c8b36929529463818ed9c262990cb26b8dadda
SHA512 9ed71018716f56664ddf22479707b6a18a7d8113deca15fcadb7a3edd13f8d2d20f700557c3c24693675be923aab7c840fed90c4e731547ab625aa53c9bbd5df

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js

MD5 dbe50831d6b5fdbdda6ac2ff40391721
SHA1 73121470a9c72cc40ad684cde8474c75ecaec90f
SHA256 4de879719da2b8acc3494d182a5bd900603b654aa79653ed06300d161feb3314
SHA512 934d0f55bb3979b1a3ae4085ee031d60e2339801c3176ed1a3e77bbbc1935d595a48598db4a7514d524f994e3c168b851f39d30ef63be7c1ed015f729914138c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js

MD5 d33939cc1367d47359a1bc76ebe3f328
SHA1 1e1a7c3edf7bfdfb4100e42955008d7235ce22f1
SHA256 a542608d115cc53f14fe5e889009915a627570394d0c5d488bdb2511413a984f
SHA512 6cf1715a345a0dcc27cc309a02cd841ca7ab5c875da948f83c2cc7f158d1c2ec767f354746e8727f77c9b32ca52c17a9276b43c2944bc8f3168457584a3e75b2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ui-strings.js

MD5 9e71f56dd6e7cbb6237d6d3a16381ba8
SHA1 bb32e467cc8b37aefbe2479ff7e0934afc95a8f4
SHA256 f49ccd72493d24c4b24a69213fca8ab7bb574fe8609cb3d4d428c8293a86138e
SHA512 cdd01d1dca82b221757925ab43d3a78b70be39d8fca94ec205de1fb3fc3669caebaab0f4ae07bb96099b9a09a581aeafde27ae29de22cdead456db1cec6a8a3f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js

MD5 d128eb537eacfa4cb30b144e61b044a4
SHA1 d7b37de25b30e4ceba9820feb4495a3b1ff9b973
SHA256 0d1a6b9ee184efd2ae577f610e0e802d35690b604a165edb501a622e4e307542
SHA512 72bed482e1c324cfc18b673003eb59a2969da3247f94a9bd8d772fb16eb60d135b34b476d6a932259f6e2c9bcde440164a52b7dc5d1aa86c7c95f09a8c01bba4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js

MD5 5af24429c11ce4dc80a0579806b0fb29
SHA1 7ba50b7236a3170b9cfc2ad28f018b160888144f
SHA256 d4d1c69dabc4233679f6f786326b253df04ba19e5b1e39dda177fea9c25f237a
SHA512 583a62d02c188850d4f151709bd21a897449aaeb237a05fb38b2be71f4f88095fff84e84310e0a2a2341cf4eb5f26687f0295d14264976d676a21f66cb0976fc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\PlayStore_icon.svg

MD5 2ec314a27c52987af291e1602262ddcc
SHA1 6ea24744c2dcfdd460cbb51e149c16932443ff5f
SHA256 be96011b7207d7f51483a9d684f7e3fb13d0f6f8efa1d13ba8cd69b914df9b68
SHA512 cbfae6ed4e1e52c44c352ca891701c46ac5cb78b23969d11e55b69f82cb8c14faa190d121a3f9033994a6ededf0dfa943fe70714ee5a390fc7bac39a3c90ee70

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js

MD5 81aa1baf10ed72f622ff8dc1cdafdec8
SHA1 34bf2e912f725fd032ffe6ed0a636512f8fd9f05
SHA256 db3a1c16ff0dc42460543f8ac5fda4676e674e6fe38b0032611c0b3039f55467
SHA512 1ed1454d795fcff907b4d0de147816cce7833c998aa826911170af381fc2654293a28831894931412752c3b8d2e5661a920c67b57c15be35ea40a52df625b69d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\example_icons2x.png

MD5 6f41ba45652055d4689de5c9c2107f19
SHA1 5b7e1d35bc17c20dccd5d679daa326c6ebc5d2fd
SHA256 ee0441d203b7219811416a55132f2d573a337aaea5edabc22bc44905d0c36243
SHA512 f68d2b02d8d285c82ef377050399fc9e5e797a27268c0993cf9b26dbe149427e929972a6f3916f104a9077cec8c57fcccd6e08d2defd452a2d889b04671a9ea1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\example_icons.png

MD5 969b4bf0937f93841d8584fba19aef88
SHA1 03b94320e5ea2fb9663d88b46d533aa867967c6e
SHA256 be853cfaca47a82c8ee3f3012e899f717f77fe262cf6ab98ee9fc689aa2dca55
SHA512 ce7c3839238b1be8433e0d494a0de4d0ba157168a3ae7ee6000d0bbed65c440b69569e270dfa1304ac220fe66fe9a6c7652c4a951e0239aec18421118b462ee7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js

MD5 53f94c558411fcb42b143eb5ae5df65c
SHA1 1eb891f3e54829f530f0005687c44a5c85cede04
SHA256 8a4fc34cc77dad8354cd55ceeca62b1cc9347e290858e34cfee18e70881cba21
SHA512 001785e29ab4f9555e2a60ede2d7db62ff4192916dc00b920aec61f40882772ef3a101e5eba0d3ebc32df8128934510bdc0cd4b621813b86184f81b33f2c16a0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js

MD5 f09addfca4bbc979597a8792b36fab38
SHA1 eb4d6bb9bb0ecdbb9bd843193f3c55e5c01558e0
SHA256 49588f6ab55ed40653d70c1a2f528a3d3458692a1c524fbd80f3c54123d5a539
SHA512 2024949d5679af48d05c2dc3933c1f2eecc3fc0d47290c8839b3a638f80c494a02b5cf3f851129980b179582faa733b38564b3eded623f56a4b5ccba25636a51

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js

MD5 1f0f4be655b41662217a7ff616e59457
SHA1 2b738e103ff0970c02307267abd0dbdf13519930
SHA256 ef053e647a95c8936ae1b9aacf415763ccf72865f1123e693518ff952933920c
SHA512 4738f6c8ff6978e8795fc95a6c61d06fb49558c29e3d77c4ff553ce5640ae28cb224d44a3ea14aa14a2745e44fd37880c81c73950e35c1a0adc6ef2e587f0666

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js

MD5 a1c9e07eda53a8c3ddf22601c8b09f6a
SHA1 06751f23bfac234909a634a839004e859f252102
SHA256 a45d5a7659aace5b92913fed463c5713672aad5396f04230faa1f5bc16b9da48
SHA512 2298ed77ae75c6c011f74910f14df5ede10d2c5f66b0798f993e6aec23ad687ed78e33b10d5e036ffc58cf8f8b53c23c688b99317633f5e3e5ad3e7356785063

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js

MD5 bf9216b045bbff4b6c92584a4176b94e
SHA1 2519be07fe4bf835b18358f428d4fc955ad7e766
SHA256 2fc66a6cac2d0c99b279dc1d59f06e9377054555b3dae5c1964e9c77887abd0d
SHA512 1a0c957b9bb487500c29066c538a85d169d30fb07a558e81a04b65acadbc347388193d60ca726d001d3ad0840c812828980338922d8486fed18a9e6970babb07

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js

MD5 69baf93811cad328715ba3ca74a1a05d
SHA1 fbc04d75973a3120dddc7abcc8b9744017d78820
SHA256 e9d90e3913048d48566bb03865261513ae3e125d9c2e2245f4f6cc89bf4b7977
SHA512 d20fe99aed0064de47081fe79199a6ff912a6bde2c3f26533a293fcb2bfe83c51806de35f2ca4ba6d0cd0059257b5d89870797117a8ed44f702096a8be39e6a4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js

MD5 7efc090a2f2ac7958235c4dd1ffef91a
SHA1 69960eaf510ce99f7efdc382d179594b2bee9b0f
SHA256 b0339df631816444272401096940f020099b1565274b30ebf07ac42702ad058d
SHA512 211419ac078f59af25e3788853ff0464b5ca281ca67307e171af19588f016dbd96f4fcc77c67f8928831508a7cab27c181d9c716b45a5eb7fe12309001731d09

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js

MD5 2c202e599c506777855a217410f6d3bf
SHA1 a65fb152b1c9b0a28df3abdb3bd5b63b6f762ba5
SHA256 d261a26e3683e56bf207a9069be9d252722122a16b835d50b2bb20bff5dc4029
SHA512 e80de42779bc9e45598002470a29618f5ea4a0a2d0d57fbc910c6bfa631b1898c61e5082b8120c85a5ecb579795707c37dd5e2f006b704b5704c801b59be7bd2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\css\main-selector.css

MD5 a3d11d8e769fdb4cb3e87b12723b6b24
SHA1 2f645255494f947f2e615db82f4b6d6c29214b25
SHA256 bd7e10b09258dbe96b64ddfaa98445332a46cdc9f92775aed2b4295412ecb2c5
SHA512 0ed8be94c9cc3fc7a848c4122e5bb2c84f7e3cc03110b82ce2749d027a7351e6a4ed17461582c02863b20278ff55d8f4b7c80d593e0b271befa4306ace889414

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js

MD5 b4326b29b46eaa03b207d722c082b199
SHA1 2298d2b2187e6328da67e059ebc9f6b63485843d
SHA256 d9d27d19ddadbf2b6f9b3267a061a5f982007ae2e03372ee1fdb56eea25ad93b
SHA512 42f1d4ad1d1f9c2544f0eb5130a5d43ed433d2890177640758ca4c9c639dc2f737bc700c270b232cd7b677912777edda9ff38df12fb82e65734595b1e409b2c6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

MD5 9c9777b4788de39a9ed31e6ab5096de1
SHA1 16be442e8a5e3203eb9dab94625ecef1d75adf00
SHA256 8810b9fe7b46622c17f1c9b96fd153b86e1ecb5a8e903b1e2c862ed3ff8d20e1
SHA512 9e8e4e57968977b2b26ee17014b743e0ca6c37ea1cc60ae584f126d14ff515bcfe6bb162cbfae56b5b537252cba69aecfc5cf3ee81b7b887ee2a15b0750190f6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_thumbnailview_18.svg

MD5 62a07040bcf8da719d3e76974de7b4c5
SHA1 9e3b6395edf019b10744ab39c4c9985381ba76eb
SHA256 ebf6c2a5e0188294375df501e391d9c7c493246c52b2c585c8dab3c06a378233
SHA512 1cfeefb8f5e5d5d7d5ae04a88ecab8ab1a5b59e2016caa91d2d6ec2d8fe7cbaa1640b62fae26e4aae7bad8248f43d57672db77f6ba9cc483ff5a17c44ecd0959

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

MD5 663751d0bc6fc1caab49fc27b34dbfe8
SHA1 26e2dc5c2c1c1c47d3b792d95340f3a4c15b4b6c
SHA256 c1685ab59fbb757cfe54b23af9eca234b6241c7c745d206600de3382ae0e3898
SHA512 72555d4a6e3151e1d6439a7ec2866fa8a05b77a68b16381f14cb07f0b69308453a68b3397af5415e10857abf7e20f9a7685c68afa8d38791ec489a1b0c1e8287

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

MD5 ea3d49a64f09ffeeecc25e4dd4e49a7f
SHA1 baba81e88dd3378dd68fc6da6a9aa98ac3306f25
SHA256 f2469202a620bbade955acb925e4666d218ca7012c3300d20cc8f4b17f15f265
SHA512 e22bba8dde3983759bffa7337d3d1872ee513af6a818f6b40afa1da4d936876b373f2d97e9951f26ea93debbe958dfcb2c66186e35a6902a1cecefc3e18069cd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

MD5 7868877b847378e5296cdd9b1ba414eb
SHA1 7078d62b1af721bff82a51482195d7655efcc9fa
SHA256 a03118ff9c6b49d3caf1b8de0c919a55eeabec449c9358a149d792de038e9bc9
SHA512 5c90cbef82f558bce1a495054a1986c109c79e1f0e0d05ce49f8ad570dc0ac693097c745a8033425ae7c55f0112a4c3095de9f7eebd6ed0b1141a7ea71fdedcc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

MD5 3f64520b75fee731a8b301abe22bfbcf
SHA1 532eb2fa1bc725fb2bb7450b567e1722571c72a1
SHA256 48a3d3bd7d51bd4e821d4803786d688e6771a4f577e7d000399e27a6fd39dfcf
SHA512 ddba329754892de453381cf98ade544548a730d3a5038adbcf686d6a6cd772827b34db583885f56c2ce7110a187a0ff7f5b7a57f337ff495169c95401fe66213

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

MD5 b8db51f0248a7f1cbef6da529c215741
SHA1 516d9d27ac4db17debdb80e7fe52edd5ac37ac89
SHA256 65ee779e90bd787d7bcdc175132890a0acd8a20b7bf71d7be48564450c8df027
SHA512 e66176360f481d4cc4016a5dbb344faad573fcc7f8a838ba6648ba481a6d29874eb5716201e53dbc45747f59d5d35ed7d7189b927b4faf8969b4ea6b7a695dd4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

MD5 4bcbdc1bd668ceb1906da6c12cd59248
SHA1 ebcb65f498fdb03d5e2f1f4f69c5371c9eb6f6f4
SHA256 8d3d595db1cac3ed504eb9e2bd431e9cef480ce020ca169bf2dbe616837ef29b
SHA512 a11e8c5fb681237fced6752bfc4f3d7df625e86eac97da68bcbdc1a36d394eacb625986d8b03981655cefaf022636e39359e45c8a93ccd673bed2233e1da55bc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

MD5 565734e128f70edad0e5c9cb7102600b
SHA1 f6942af6040177096da0d131b06f08300500321c
SHA256 0892bdea327bd7a4ccdb7b2ab2d636a3501e00256168758e0510c5114282a8a3
SHA512 b2b54bc3fa50f0cf3e254b6f64aa2cf345b644ffeb1c614c3e83b57268bc22de6149ae9491fa943e457d0397a7123b8664132737a2346bbd13a36013b35a6cc5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_listview_18.svg

MD5 3c3ec02f464d15831a9a4e3dcd02cfd4
SHA1 be24c85b7f4dfc644a14f4c066847fda10ef47d3
SHA256 c0bd8c21285c02fe6bb1b680f6dd5ba8dee4ae959c5c74296061cbddfa7f4677
SHA512 ba16da829440a9b62b5b1d20ff63eebfec49ddf5df8267c7181e93f97a562775771dbf3f9030420c667686eeb3d50865f99e8c4017609782ad54a4549e90508c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\ui-strings.js

MD5 d3b68a2af0851a7c1119eb296e5b4147
SHA1 c6746952ce7ea4e917823b41618207965cd0f34f
SHA256 25280db4cd6c386531b575bd31855d119dc540dafc8e35354d58f91126f7b8fc
SHA512 3ebd078e67c84ed55040151fe7667dae50781d19108d77e949fde72bf3de47e50b825f7ebeb585b292a7056fae687e03549da626f34ddcd62e90292265d06036

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\da-dk\ui-strings.js.infected

MD5 28836a069f31cca6ab3775ea2f303162
SHA1 83ba21b73b44dc35e0d56881fcaef4e73ab45219
SHA256 4ed85ae1712532d8ed54ee8c6911f712df99b6176ba71d16e0869014a69e2361
SHA512 dfbb85848b03cb5a3abad1553070a44521412b60b1391fc1206b0a58dcd260e58f13265b82e65391837c2e2bdb453f5bece0a84d1d538c63505b10102979e6a0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo_2x.png

MD5 90067ab2e48ee5a21e163d51a86c12b8
SHA1 7b455878bafdede2b5c33a95eb157c7cf0ad1c98
SHA256 31410da3c291a2d6210abed91d945001f107bcfbef3482b4250c24b3eaf14042
SHA512 fdea0ed5ea46ab4bce244eb984fcae37838eb8a8d89383eeb49890ef8841be32d282996749c4df2ed4ba80d9f45df90d176199278d65272dd2c75e7e16ea17e5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo.png

MD5 95f033338001f94596a3177662c9d4ef
SHA1 7728e4c3dbcf2ee2f59806195dbcdef0dbf185e5
SHA256 5cdc0152ad2e33fc25ca152d93d933f1d68c8576d5e4d377bbed7b2d75d19b4a
SHA512 3b2452c190156b04facf6c72661121d305d8229bcc0813af02485e64a0ea5f22df85538525722c8c9f374359cd88d591baa732f89f98281f4a06a0bb40e17fc8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js

MD5 cddf2f707ad4c1c8a7fb6dde64eef8f2
SHA1 44ea8bf1588dfc4e4c4e7dd094c482e731788aa8
SHA256 e1cbaf52e8051a37321eac9d93d2716581de70827486727b38a47b7f3f35a689
SHA512 148c4ca3f24c7d4543a1db6d439805010b40f03f282a5dcb8854d4eef881ae2106d79497a27f0c37b8ee0b89e1cf8bd7165db337e7545064971c0ed9fd34b569

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js

MD5 2072d2e31d88f4f3307050c779455d79
SHA1 68a2c605d6d17b2e1349e60b0f78e4a875c9bffc
SHA256 5c2d88f3b0f91cca88a5b93c482550226ffb470f6782dc2003b21dea32e48e46
SHA512 e68605002db7901ae5476df3a34391111b12aa9677fb3b2f72b90424f27c1becb7f99bbb5d9c13dc7c2433ff7d0c7644e956c9b759d09729afe4ba5ded2e02dd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ui-strings.js

MD5 8950032a76f2076f94f8f625122645d1
SHA1 986cb119a379a463ab5dc09d74cc41410f233c53
SHA256 87a73bcd9750f3da0a7639d8fe6272fef975fdcb8abb13065b4a7af626db2987
SHA512 cacf2ba1154650b5a36f853ea3c80d082612befe37d5559ae12cc44a46878d17ea9da528164a1c4b856538702a22392500042b02bfde1d757b7622bbae817156

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js

MD5 55c33cde7128c1fe4fe03f87b3c1db61
SHA1 27513b01615c79ae2fff8195ffd7c212f7790935
SHA256 07f726daecfec6dfb74366e5a094fbc243ccc17b90358ac0a907df6f81344087
SHA512 c73bad4aee5ef9008ccd756346d1eebad77eba9acd83847fd3fd041b6e3309100bb0e482325063df745b54427f42434f3a30478a169c348bd2c8001f64c4ed05

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js

MD5 0f3ef4e7ead47542768aa15e552faa17
SHA1 43f361d9efb2f7bb26064a7879dedd1d34dd1302
SHA256 812573d7436b89497192561f63d5399b3e530d8ca50f8ecd8e71871f6e5ee7a9
SHA512 5f4debeba408f5d7ab0fd439fb835017cfb58db841c7c140e5c836bd2c1c2e834b50531b4f220ae9ebf647ab8b14b3ce68ec6f13862d4b1eb9cee33a6815eab3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js

MD5 8114cda51a68db0b06b07543130c93f5
SHA1 ad8d86e3fc1b564991c965791782be6b9fdd58af
SHA256 8e6264a6b8ad8f716dad22e5d02419f718e2214cc0b6c445c5a960939fab438d
SHA512 d7d25cd7ea3e7d33c72e0c0829479252b4d5d374960774fce389c31fb5a58c4487b54d791866953c1e52e3f5451911a83f2d37ac7b582a494cd053cfce5aac74

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js

MD5 5569fce466318056f9d2cc32f417feed
SHA1 244ef40d9f4bd7d041f14fafc32aad3b9488d50d
SHA256 b3077e14cc7cc67446ccfb6c58b2d55305ddd6c85f509c97e4b76b80a0a6406d
SHA512 d029bb8a6c59860d30d9a99b069459631a4e5526582d5ffaf03820a7655b91efc83ec02f1d0c31333bf6df3e55bdea261a0b48bf38e7c2948084c894ccd0caf2

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt.infected

MD5 23d3a1852c5703dacbcc8cec1bce3014
SHA1 1cd7a8dad0a9394c282bf016e91b83c2bb858e17
SHA256 8fb002d24227135df05b25df6f66a4a53d605af997215659ea86bd384667375e
SHA512 4def952c2c93b837ab23fe144882b329293e453dbbbe6561935c206ac83c741d5a86b994690cc89158164595d6a8258e1416b3fde151e9ed4bcb222dccd173b0

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Stable.msix.DATA

MD5 da531fefe5c41fc6fe9a474166e879e5
SHA1 b279de1811e7262afa6db5dfe6219bdb0fd64e83
SHA256 504e56586e850437a2fbd055e0940581f110211c1beb21609ca9dad24ca210b3
SHA512 bca7d42dbc87d0cdd7631bdc1807027b276fa6a4ec33fb7464e36d3fd87d9c5be3485ef9f4bf18333ed0f9b6fce76805320f113f9965e29a40170f246e1484f7

C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\000003.log

MD5 65ca41321a3c3d070d0746aabd765022
SHA1 ca8585ee92d611f2cbf1ef3a814437982210135f
SHA256 dbb4ccba6cddfeb11a00528f27ca64e988d4cc66bc61f8801e9444a6c07fc2b1
SHA512 ec908aa16b94bbee275f1cc927cd7e2335476869b14ab3898ec6098f46a76746fbc79ecbc78c1fdea0550dcf8dc221bc6a0e629579c858fa4ed87e56e1546450

C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log

MD5 95ac4c21357b8f46381aed4ad1b5dba4
SHA1 1233581abecadf256f132d229393e6e64f4b6c2b
SHA256 73f4b125bb2c3ee6ff272c31401217e62abee5020e84912e018ac8ef9ffa540d
SHA512 e07eb80ba2eb11c16dde250be55fb763716823e2b474c89c730eeeae8fbf1cff05a344407b4b02dd17fc66264287f96f7624bf2c754acfa73e1873dbd35cbe14

C:\ProgramData\Microsoft\User Account Pictures\Admin.dat

MD5 3c2801b5a0d2682ad499072b56e0b0b4
SHA1 0b6a2b943928f34ae81b135664a52a4869725ebf
SHA256 d1a8c41377c59bda48ddb61bb2c4b69754fc6c1cce7553c9feac08597a3d3765
SHA512 7e76b423a1ec24660cb3db8e61b37b9a99c0ab553e6636af459daefdd2262773637aba130d25f954b18032a4dde3826bcbb4f269f6d12f8008774bea13fca2dc

C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi

MD5 3cfab6a145c8f099839b41016e2d4290
SHA1 cd60ec701b985a9bc03f22e9c559a1285604a9b3
SHA256 a34b1d55b1df3fb4197d91c90587f64d4d2914ef955f0264d47e6f6f7c1f6d34
SHA512 8328aa03b69bff0a819bb855240195e8ebc1a2f667fdc204413544b839d6f30e86650a5513b551e8ede7eec7700f5da1831aeed5720b2a5b121c8fb1cc6d992d

C:\ProgramData\Package Cache\{C7141A99-592B-4226-A4E9-B767C1D0FBAF}v48.100.4028\dotnet-host-6.0.25-win-x64.msi

MD5 3780a1fab16ac6c32162464f9f8380af
SHA1 86e84028a32f957b0d7186289bcc5b75dc178156
SHA256 e5f4da987485025088fce2917f8b1832e955f5094dfb2b73b26135809e599a27
SHA512 d7818776f1abdd073db591d2dc92e27c042e7c551fd9aacec9fffa3b7fdde6ea8dfde28d0c4824dc2f162bee282eeee6caf8c9c6a95026338248949a1c568448

C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.infected

MD5 d303c8bf96a666d6836a3abaa0d52955
SHA1 6469da5d3f6424da305aa6986d416750b466d312
SHA256 d9f9a1a936abe2e3387a0724e5fa603565d29f929666c325ad2c43d80e050f0a
SHA512 1863d86e42a23e16a2e62f66a9470580c5b756b37e3ea2b07cb1917eb9e2ccc6c2e4c90f9169d362f20f08ba72a3058cfbee7fa48855e3f1dd741a0646aee82b