Malware Analysis Report

2024-09-11 01:49

Sample ID 240227-wdpd9sfd76
Target 951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.sample
SHA256 951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa
Tags
medusalocker evasion persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa

Threat Level: Known bad

The file 951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.sample was found to be: Known bad.

Malicious Activity Summary

medusalocker evasion persistence ransomware

Medusalocker family

Suspicious use of NtCreateUserProcessOtherParentProcess

MedusaLocker payload

Modifies boot configuration data using bcdedit

Renames multiple (4373) files with added filename extension

Deletes shadow copies

Renames multiple (7546) files with added filename extension

Deletes System State backups

Deletes system backups

Adds Run key to start application

Enumerates connected drives

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Program crash

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

Interacts with shadow copies

Suspicious behavior: EnumeratesProcesses

System policy modification

Kills process with taskkill

Runs net.exe

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-02-27 17:48

Signatures

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

Medusalocker family

medusalocker

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-27 17:48

Reported

2024-02-27 17:51

Platform

win7-20240220-en

Max time kernel

122s

Max time network

123s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3056 created 1064 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (7546) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes system backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe\"" C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe\"" C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\cipher.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\F: C:\Windows\SysWOW64\cipher.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\MSB1ESEN.ITS C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105384.WMF C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152602.WMF C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0390072.JPG C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hr.txt C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\deploy\splash.gif C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_snow.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter_partly-cloudy.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107728.WMF C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PSSKETLG.WMF C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Clarity.thmx C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REPORTS.ICO C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABELHM.POC C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-middle.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-options-keymap.xml_hidden C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent_partly-cloudy.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215718.WMF C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR28F.GIF C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN102.XML C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_rest.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\14.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287024.WMF C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\currency.js C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00403_.WMF C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\header.gif C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplate.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCOUPON.DPV C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\HAMMER.WAV C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_hover.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_few-showers.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right.gif C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ADD.GIF C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152704.WMF C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7wre_en.dub C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Priority.accft C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.common_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_dot.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_snow.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\localizedStrings.js C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106146.WMF C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151063.WMF C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\TAB_ON.GIF C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\clock.css C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sl.txt C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Windows NT\Accessories\ja-JP\wordpad.exe.mui C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01166_.WMF C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_over.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\en-US\MpEvMsg.dll.mui C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl C:\Windows\system32\wbadmin.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3056 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 2628 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2628 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2628 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2628 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3056 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 2552 wrote to memory of 2772 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2552 wrote to memory of 2772 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2552 wrote to memory of 2772 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2552 wrote to memory of 2772 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2772 wrote to memory of 2540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2772 wrote to memory of 2540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2772 wrote to memory of 2540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3056 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2168 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2168 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2168 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2424 wrote to memory of 2420 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2424 wrote to memory of 2420 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2424 wrote to memory of 2420 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3056 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 2444 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2444 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2444 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2444 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2144 wrote to memory of 2136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2144 wrote to memory of 2136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2144 wrote to memory of 2136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3056 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 1628 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1628 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1628 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1628 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2472 wrote to memory of 1576 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2472 wrote to memory of 1576 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2472 wrote to memory of 1576 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3056 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3056 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 1032 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1032 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1032 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1032 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1740 wrote to memory of 2412 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1740 wrote to memory of 2412 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1740 wrote to memory of 2412 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3056 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe

"C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill \"SQL\"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill \"SQL\"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe

\\?\C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe -network

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c pause

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\C:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\F:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\A:

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 708

Network

N/A

Files

\Device\HarddiskVolume1\Boot\da-DK\HOW_TO_BACK_FILES.html

MD5 25bd57fa32c3a840896114bfa114ff28
SHA1 537335ee01b89cc6230e6390b1e9991c1ac8e687
SHA256 67b77daba2e55b7d2aab5462f73e50e9a7c9adba1cc83e35bc19cb064f09818a
SHA512 7f3cce56d33e1ac0d4aa67f2caf910e8956aec61674dcde07bb593e9250b3ba1d646093c5fbd955ba23e4bcbf5fa1a0bd4d901e77aef446f7175d16170fc4df3

C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.locknet

MD5 936955f118f239d690d56dd46c70a7df
SHA1 5cdce1c1f726eb49623019ef347df5c972f5ed6c
SHA256 14a8840363eb4291dcd529457a6f62eae5bd27ae045ec4e28d32fc7d8b16e593
SHA512 557c5b6b1c06f353e5b19a4c7234d7be43df56db8347d8dbb5362513128880044ac32a765bcd1583d1f925f73e42ae2be67292ce5d411a802d08c74e1162aaa6

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 d21abaab6495c93bc43734d2ee4fbc55
SHA1 6a7376f70fa737291fbe081a6b023eda573ebc6d
SHA256 37996e0f2c229f330568c4991581cbb84ebeba7da6ca013795de74d0110f5c6e
SHA512 bf1809ab5585f2e1c9b53ed90b761b56658b0ec27e7359c246ce94d6b98f439d56714a20e94e3c4f99407132e3f89efe2a69511d48055c376e9e60e9022c6232

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC

MD5 a4b8265edab9414625041e2547d5cdaf
SHA1 ba6fee0610a1af1b00b2c3fde7e24fbf556f044e
SHA256 4297ffcc3a2062571de57fa8e0f744c7be1f6608511e546571e7f17e2e146638
SHA512 70b239183cc9f3f20acbf79aee6bb5fa027609ee2725a4ce7c419c1c7464477a108517f25595c7babacf6d8baab245633995c6a6c5ff3fe36af83c36774d82cd

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10

MD5 6fc949c1bf6a3b151f320064e0047d84
SHA1 c7d96659c05811e54f13762b41a788b7871a526b
SHA256 2c42a2b5918b94e6162ef17751ada19642c4f9febb959a353e9f0864aed4b6f0
SHA512 283d167711028fb9b6ffe162d017697b9e7d26e40457ae2818dc4508413ffe61fd2e62e13bda71de92003036f5b43f1278fec18f98c3457b43ad4a66d1e862d5

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5

MD5 83894c6988c0a4384ff6095fff20bfc0
SHA1 29612e74e6b14ae56aae886a7588ab16ae6f86a0
SHA256 49a3c40b42d7cf8a4efe4038dfe8e013fe232ec353a39c252c1e1fb083a42e5e
SHA512 875f107ebe86b54df0ad67f989d40043bb00dcbc80650ac78a30ae608e20ff106dfabd8bc8c774d3f2816c978c7fbc67510b3320e03be8697716905de5269999

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7

MD5 3326692ab71aa254360fe6114533f398
SHA1 35979a693d8066349d01e1660292dbadbaa34bb5
SHA256 96234acb9f9e1ba00e06af78618d8ea6188f97360aa0e4cf3228e1a68c5f5ab1
SHA512 783056fdd04f236a1ea5b9631c169a3ca7081b9b6460b00ca9f84b40c64009ba83ab1f64a2798d617d54044d483aad1840ed614101f8fd4ac5057b81f62d4598

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 19a2c0ea40162eeee588bd99c1afe5c7
SHA1 13232ffcabe4efa8220328f910ebd64fb659d60e
SHA256 3df42ad427f97eb3456f83000cf8007340671ecdd433cba6e2acc69d5a7a7adb
SHA512 eb82cd6c328ed749b8fafd60c9fae83fd74310450955f763a2ec193b967d288e825d7a84718d01d818d6667394802bee256283b95038aa0d0bf34e4eacc904a1

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 f7f2cfcee36051f190178f8cb0575319
SHA1 6993ab7d5bc6ddd7903bef0754995aad17418412
SHA256 3bfc2274f2a99e3dc8498e0cb1a177766b8b4e4fcfdef21aa963156f8a9ac8f3
SHA512 ac6910573160cf4246530c4424ca0e172bf3e25e714a4ea0edd09998268bec8c10884dbcd1ba0481ddb016a801432c6074b6f16cba79606e8a75afef8d0ba38a

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf

MD5 af383c3c55a660b798dea256279dda36
SHA1 4ef78dae5cb550c4ec85605f2d5618e434b01f59
SHA256 a191e925fcc04d27fa087a96f0b6cb75f83771f6663fce8840b6304b8b0a7348
SHA512 1000e56493efbd3c9c74544cc1e2fd744bfa19c5882a7946c4a3e1085d26f8d6038d79bdd6eecae5afb36a761a6ca43429df1ad51023d37b9cb31825582a06ff

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt

MD5 fa7c71b6bb93bc40a5b962e40e6e7edd
SHA1 19fa4d65787a1cfbb6c5c433a343580844c19441
SHA256 a56c7e86c1e1103078f4e41969fabba1f61d45918119c5646ee02fedf9a20f8e
SHA512 3992cb55d9ae69a8f52ddd9b47013ef3b5137199ed0d6e67043d295d5c4d54aa7e3ddf99be0c547c2b5a36e19b0fe7f25f4af53f64fe23fcbf598afdf76f86d0

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf

MD5 e9e2944f5bc59ed8b40e8cc6924eb6be
SHA1 e783993641ab0ba7006d05514af2a0a3391f7c6b
SHA256 8fb5acfbb2c2d5229b3006b1835a000b1169a71d055a8f76b7389f522649c19c
SHA512 60e8ce31a4dcec5c07eb0994b987eb4902911fcc4ef5556f0c4985a53e9edb595498a9d78b4d580a719c41ea3c2f00d37d3728a78a2d16a0cb9ae5079be3e3e9

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

MD5 167ee65c002cd9e6f213b79023911fa8
SHA1 33d3cdf78e7f2b9b2c267c3ca865d614d3fdccce
SHA256 8e474dcd7f02a5a04b1519e139611dd2a3d2eb05861dc714d95638be31595da6
SHA512 b0ee5435167aadac3f23979716895ac8c1c68b95bf1c649684d413918ee2cf5ec99fe4c82e30297da085f379a3f5ea58d2d936442093404aaf55064e67cc1541

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html

MD5 f265d70dc87b59cdcae5890c0ac0febc
SHA1 bf08c36eddd23a42e58e9e890614741ba2cf7893
SHA256 ab65535ba06bd26edf1b58793954cca74a8832161964ad3dc00cf54dfce64ff5
SHA512 fe25c3afd436f380965ddab1bf271b8c8955b617f859803eace838862d2ba771435a7112cb00a75376bcb4bdfb18b33bcb895884061ca3446207ea124b9cadae

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html

MD5 901fa7396e2964c2eb27a6bbf7922195
SHA1 a27d1593bad56eee359d254f3278571b558037c8
SHA256 f9bfe87a5ee790cb26207c8051162e542cafecb0cd6a0d9dc8d62254805812a4
SHA512 a9677880739a850127c6199270f2a8ffaded7293df452970bc7d441d415954bc2615aaffea5b602d9be4722a026dc48a0139c91c89ea8e3a4ff1da8440032b9c

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden

MD5 7691a70fcfe7d834f235a9125a98193c
SHA1 bb0f803a11f5bd632a1dfb45fc85314aa30d72dc
SHA256 2b9079c4a581b39529b837560245a779fed17cc439cd47dd176518eea1f6e134
SHA512 fa3dbdafaa4fe77b61d176763a3ecf5085e2dfb742ed2becf0c5ca447a4df1a2560b34acc35d8388c066ebab45366d36cd2b9a7ec5eb4031b5830b307908ccbd

C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 78561a5c01af657c9ebee6836672ad39
SHA1 c2e19f9f575c1371f10b69b1ab89490163d4ce5e
SHA256 89c7c18cf5adbedd396ad57f37bacb29fb608b201d51840327572d014e3066bf
SHA512 52a6ac74617f3bed99ffdfc8c70dd47d289c3c0cbc58d4305a6ffa667184c196400e3510a9868dcc45b171d8adfd518597b0f1dc4900ffde147ab25a7e9fe755

C:\Program Files\Java\jre7\lib\zi\Etc\UTC

MD5 c937bd2eebc35ce2deaf7b3d702f9c83
SHA1 9ff4e167f67d0cc911abcc9b35ace042f0925bd0
SHA256 06df069b2430cb2aeee36f89eda93b3129b6127f8134c00894432ee7305d2811
SHA512 141bea59c1ae4111ca1bfd59929ba8f92f0d57ad9b57f5f9a1a0343412c8fce37e7df899d97317adddb696e9df943a70edbf024027e6c4fee15e96d586f89d0c

C:\Program Files\Java\jre7\lib\zi\SystemV\EST5

MD5 043627b6f1efb6126f0770312aab1c67
SHA1 1425b5d06eb6402b915a12ce5930c7f7234282c6
SHA256 caa5f919400ecd6a0cc255b4450a4ff82cf55530ddc7be590292109ebcfd81e2
SHA512 a4092200597aa15a223a70e6fbbe43bed688b965b95d125c7cd3647d13993be71e348635cf935c42171f8d455105d4ae1a9619c862475b87424e7066d154a1dd

C:\Program Files\Java\jre7\lib\zi\SystemV\MST7

MD5 f15ce74a2e24610b19ace83b520ea057
SHA1 22e0a9f98559384a17761b3ec997cd43600985df
SHA256 b464b3cd40c2a7806492a401cbce36430be690365657a7d502444835af0dcc78
SHA512 b103ecf4e70e8e53311987f0bfdf3e79f0901d8d59d19eb9cc77b5e772ccef747b239487be05047863643bf5bced85608f498e9d1980d1afc3ea5da626d97d2e

C:\Program Files\Java\jre7\lib\zi\SystemV\HST10

MD5 b10e4fb1f1b353d789ef5161b4721b90
SHA1 e01839cea55c9922148582970929772c0cb8ec83
SHA256 67f69a16af3a832a5a0466bd2ee380e7b3e897fd3264f0981ef304af921dfa8f
SHA512 71c5118f9e957aecb051283ecf668d5830e1922fb8cd643f8150345091a9f39ba9bda6147b04f10265383cb114b0b7579cdde8fa224dfd441aa15e44dc79e0cb

C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo

MD5 7e1f409f238e6f57471a91ee6c7f2427
SHA1 b0319b2acc6fc4c91cf3ab5c21bb8ccdbb262f87
SHA256 73690609675e8969d9519d55001623830b6c0545c9c8e2ebb9e9f50e93654385
SHA512 2c333e0d9c916fb801855e6d39ecab2044c73d523b8cf733ead768c6169c2b84627451831f8e0eb1c3da1d4d176ba2da1514afa528af592a1c80230592564372

C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo

MD5 6465372c384eb31d8fcef0e13ad8c273
SHA1 823afe96ccf22a16d2aaaa47a3b2d58690f7fbf3
SHA256 03ecafd9fa1c9adea20a783cc503ed36bd71039d1e5b4869570731391b3b5499
SHA512 b8e9cb816ead31615977ddabb6cffd9994202ab8ee721184741c2a8b00530188c7bf521783572b0cd88b8037cb1ea5f14062514044b0fd1680db123b38b4a0b0

C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_F_COL.HXK

MD5 eb00dfcb02bc94424e71972a576f9312
SHA1 2604f892cf2371d51dd4cbf4f112bdcf8327ac92
SHA256 036fbf726dce07413b2c09ec011a2f12379adfc51285d5756391587903ec52c4
SHA512 b782058c21d870d8c407d515cf129c80617aa618eb8ddc31617a83cf8f2d84d1e181f2a6330ab148ddf01cda0a16ef43ffd32de0ddb0b94560ea44ddf48375fd

C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.DEV_K_COL.HXK

MD5 5bb140f3175cb7f8406413aa8eea46b2
SHA1 2d0dc1916d0fb6c4d32c327e7241ff5d415148b4
SHA256 eb5896c693ae169031c8e3a01e93c0d5f3ddf3c675934d065c48c37930f88e45
SHA512 12840ff63af9a4ca26e8ec77174190b35ca4ff7b915f3a3b799096a2494da322f282f2b57fb6ff3d7edee0a0cf590e8b008ef22d581d18dc6844c51f23c12280

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

MD5 375021aee8f7f6c626fa60c67ba7fe16
SHA1 26110bd54c70d4dfafd6f425ea2c5fd3af426970
SHA256 c47db96d31b293ef3d359684f5074cd00464eee65566c88f33a7aa80e84e58c2
SHA512 7ee26eaa0ddc5ecc54d6f88f3b300bba7601a34be0c4922e400671849dcf58be1ae480ffb11a0788cca0b64bfdf4e11b7ac6e43872b3b3c0f08fa7bf7a89a17c

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\TAB_ON.GIF

MD5 f322b05bc573622b15a1d5be6e51d044
SHA1 6c98a9f18b1a631c3b31a35c8cd07f99d19712f8
SHA256 569acaffd35ee573c995d9e6b000e4c61c4f2ac0248e6f9902a68c8c40d040ca
SHA512 3ca69d46c14539ce8329c20a96c9f93e9f7154b72688430c9167a777dc9ab766bc8168e8d66f2da7f32c50b998ab76405c72f815c717d008a47f5993f7a77897

C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_K_COL.HXK

MD5 cc7668ba5b28ccbedd0dbd617e3673ec
SHA1 715841483afc3e7597405464313f9b87d0490756
SHA256 6002730fe366befdcff4651b6e465fdc8276d41f8872186666b1413fe6c4dd94
SHA512 b78756a0a01313e6a30a52880628fd5412b371cf0194e08eea8d38b76f135edff3da1d70ed68c3da5dd5b373b58374bc811d849ca02b95f0471616f9273a781d

C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_F_COL.HXK

MD5 873af0b561fe8dcb31b1747fdcc8cc80
SHA1 5a5f4053a35248ebf2e5d226d1122fbdd6c6c5ad
SHA256 5137e4dada48b8989b8e8a72d5cc483bc77b55936165afb0b2c5a2212275cd14
SHA512 2809b7b6af76bf9a51502b1ac2d001d391325e2fcf47d89d9a2b26f65f2f97edf35404fc653ef43bd3f0fd3c4704eea84db610ca133f0c25882de673a744d73d

C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\GB.XSL

MD5 d82a886ef4e5072ad21271ac62a2ec3a
SHA1 f83ca5b1f1dd6fcaddb3ff6a3a5f35c8259e464e
SHA256 c62c4ad0ae15f242e4900bea039c1d5523c40913936be4c185a26499a9c38379
SHA512 6d2e048d524016e23e6b60a900479339ec3bb8fc683f6e9b2d9b3d0daeb576ff7e323b162979a1792b00460185c5ec683e0c89ddeb7b55e7af8645a43d98446e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\TAB_OFF.GIF

MD5 13dbab3f3166060811e3d96ac38b671a
SHA1 9221f765ce03c0d3dda9781edfce7bf0735b8a8b
SHA256 73d978f05b4a986a3255919da06f2281bb87b18381072bb14bb522dea35f77f9
SHA512 497c2bd8c4b022d73050bb89cc4dbb0ec26d671f5e089fdabc8313ed3033dcea5512dcd06a3fc83c566e3346bd3887eaf3f5172c6c62c9736edce300215eae8a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\TAB_ON.GIF

MD5 a2b5e1f2b512ee6e74a3a2dd0e8d9258
SHA1 7bbc165bf50d92bc94e533f863fa2eac0024562f
SHA256 e73859176749c1ba3afcd307a2c3df91e14f5b37eb3c1caf9f25e478b8abab41
SHA512 25068c28338ba5ced210a848653b982f4dd24b54c42b6fc54d7fe76fa411495c85860efecac9134fca90c2929b2f01a83d7e6de6e36d2930d1f1c9aebdd52d27

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\TAB_OFF.GIF

MD5 5db14dc7319a1b95b943d1a5e234c6e4
SHA1 d9addb945e5762f9bfb1a20584996b7e0a100730
SHA256 348387e37c608d119f84c58726fafa03d064906c73f8951d2280b9dbcb2dc2a8
SHA512 5081490774de201f55e476197e70f8c7686ac6f9c508efd9753a1c00d8247ac71c30d0a79227ea96db198b374110cf6b51abf546bb909d18eeef73f2596e0684

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\TAB_ON.GIF

MD5 ea6e4b1315475a6e88362d13d74cbdd9
SHA1 4ba9fdd657a0d55f7fef368a9a55e487e891bf5f
SHA256 48835026cb012dee3aca9190f3a160913a6b42f6fbdf4140c95b4fd08aeb8816
SHA512 f186d63e8ce670ca27e6e85c9426ef9c676ef000046f53e3f62219f68da9029fb8943eb8a48404288381063c3ec43c86c445942f7d218aa3f390dbab221420e2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

MD5 f4e91273c0c605cc98039b845d8a928b
SHA1 eabf0927059d56fbc4d914b18451c4b1cc6e70e5
SHA256 1c7771a941b631150bd6b48fe71ed335fdedf0ae0e0ea6c117c17403c3a69d9e
SHA512 63b824216dc20490e421643aa88872e2473f2f7daff30546373cdd6643885ea7b144ae54710ba3cb3b389de802af433ac0c7486406f34e6766f664da713680d9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

MD5 992de91d635511bfe6b4145fa02eda13
SHA1 4e68250dee746ccf461b9913ea83fcc9ad2bb67f
SHA256 1b94e5164cfb89fcc95766b2c8e0b635b8f0f31b2cae726250da613da60f8db2
SHA512 5cd877ae63a61ac243f496eb627bfb9dae7b12f97265bc60677b49d30422cecacc49069e1e585611298072a6c7a6efcab7da154a337e705ba6a95a75810362be

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

MD5 3059390d569f8cb73a832c5ea5c74148
SHA1 a84b62929df5a37c41c7b9553d67d39c16017ee6
SHA256 032bde51b079731f0dc7f7e4648388b7c7173d255b4c56482a0632efa1451b6d
SHA512 1b98f41c45c0fd35afce551b1d0919cdfe5f8bd67c2bced8a71c4ac057bb47d07a1bc599055f8e42b1de713a8119042d6b734de0489888999e180eabc79562da

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

MD5 99f3fb70a9797b9c69fadaf722ca2532
SHA1 3e537d29a52bd1b597f55c879c70ab21f571d36d
SHA256 9df45acea306bb61db0c156acec856c98804f8b62ed37bf64cc41941207233af
SHA512 9fc87109911580805d29a8944ce2d02f74c276e66352779facfebf50ab95fc20de2167fc162f1c77c7be88e8af480b18a3b327de3007afbdd13e79e57b233f34

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

MD5 7eca20f67020388339cfd0ba70acedfa
SHA1 1e8c8ca58e43bfb4ed848a02c5eb5a317b6b826e
SHA256 493fbacf56df4de3536d5397cb3f03f117bb6361994e9e16224c894d3f9b27de
SHA512 f07a6dfeaf80205d4f926d1c2815bc099b51fd8b3aa2ed601c6f12951a991535ce0d9ffbaebde36a9103c490bbb404eb3eb59a5eb166184b1496ab033678e4a7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

MD5 e66754435272ed0331f04305848db063
SHA1 5e93e82272775d4953c787bf1e4541532b75d115
SHA256 85d0c9d3f928c0840ed529d5f14728cb69576660b8435ec11d23886101b8a8de
SHA512 d9410b4dbb1e465c8b1bc9ea96dddb39fb2d16c3e9f61e80d0afc992f5fc18f13ab200cc38b56a54abc876455cd8f86b3624c182e8924cb1cef4c2f92bf788e0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

MD5 8130cd5378338ea20982507cd5618f41
SHA1 bfa91b6e9496adbaad7741941900c5ab32294057
SHA256 f265d3877494f37f88a82a85e627477b8795b2abc611ad6e8175ed12e924ea8c
SHA512 cbc7a00657d3873998375938f083e5c0b7c49f0f6486224e2b660622c657a31c8c3ee1928fba750e0a01de66565f837197363d62750eb4314213cd9c450aeba3

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

MD5 e29167189b6e3b0a5237f5cacbca68dd
SHA1 2c76c37ccc38d8f8ed2b6158faa277aacf8a2cdc
SHA256 e2d6fb99b25f3842463934052baed546eab1741a05d85fc4375bdf96723b4b86
SHA512 e3d15c3b5f33559961f64dac3510fbb983c14f021822b55ad13996649af16631c155f03a101170a5f591a6cc8d53aa20d8bcc7b2b827bd543ef2dcabe4e209c1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

MD5 ddd92c7a2652e126115d6aed48b837b2
SHA1 89fd10c4f1a3aba21a3b7687e99b7d04a6b1986f
SHA256 72d4607f490748bb24d35bc63a3de626151e4b977f60eca8ec36cb37abfc6fba
SHA512 6cc6a0eeac60408ba864dc72ab12c7f6810ac86cc69006f07cf82a3eddda247d661a4242634a91c1890fea75bf997299dcdb9e4b10ac189b01aa88c79c33fbda

C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml

MD5 8407e81a6524e00858f2edcbbbd48bf1
SHA1 97bf4b4350a7d71fb706d007513568f117ed2735
SHA256 48b7d645c838cbde3dd6fc519c48ac22950557eaf17a9c4832c73655f64cd8af
SHA512 6f603f92cd08066ff5ee1f2b9b9aa203e2bae37b458e14d64c479a32264de784d59b61ed508225b76b2ef2c3b67e0bf499e1fb1900d172f9faf78235ddba44e0

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\BTINTERNET.NET.XML.locknet

MD5 2df152bb5f4043a889d50f1e418e6aa4
SHA1 e5fe6e6fc1279aaa2d2710ae07933c6c2ed5d264
SHA256 e09740f8d5c6f33d2eece1ad6e2a9258ef0f674dd06165714a04898a7cb5a54f
SHA512 07c879c8e7b6063475b2c8d6278645a196572ddb7c17ac85d105239cb5a81c2c306ce4e323ce742132cbb06e054f5796aba96c85cccbce41fa57b179da6f5a82

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.MX.XML

MD5 04a040e63f34353b2abd92e8ba135971
SHA1 0b8878482d3a21bc4996258bee9e6139214e9c4a
SHA256 94c60cf9b554c7dba39f8a1cdea0955904db7269b7428e0d3fa24afea8bb383b
SHA512 127e1c5501931a3515c6e0b20245943c786efc5a03aeaedd39dc16f8d2ce7707859faa20aaf7592b6a536ee1d06d071eb79d0fe9a9341ae263b22107cec29eb0

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck

MD5 53b5ccc9b38272b525f711825b9014a9
SHA1 0321c5b9d6abb211236e0831895f70c5fe58a767
SHA256 47d07f43f89cca8b45503bb2014bf024281403964d55bc4127c564814d9eae3a
SHA512 07fd957d7850c2f0178817aa588d0024f861661343e0b2d4249a2cc73ed665164bd8dff911d0aa62e39087c1d222151c02d76314fd53c32f47779fa6427c5b97

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.001

MD5 a53320c0d183434b987e1f3dd1f0067a
SHA1 3fb3c46d49836ea4dc14ddc612d9540ff2125b7f
SHA256 a13bc6de8c96d944b189a59d025f78ea8d3fcc3558e4a0038dc5a21c113cf2a8
SHA512 a72d4e8fa11e53ac223397be2560555ddda4ad33496e9d7a63e596186c8ceedacb91c34ee06f89c20f8100fa05612f04346cc08371d218175fa4f0af38e16dc6

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0001.000

MD5 a887238de286e7b1b31c4513b98f8c39
SHA1 e0661fc4e8a59fe4ed3caf7e66a30d1286ef05ca
SHA256 70456660aac410f6b428e549da77eabb6ebf3a378a7abb90e934a1a1e4279179
SHA512 0071c2dc03c8ece90d23f65a35eb3c74a0aa42f20f109d15a8b1ecd38dff9fe935828b6f5d1049ab1430fcec4d04f4b226683bc39e5be28110227185d8cc1007

C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi

MD5 2ca90f42a4c1f8a7b3bc8b943ee10353
SHA1 122349f8fbce62013076fe98287c4df660557135
SHA256 f083cb702be62c7889b036aab9469287ad623b905727c1df94dd0169cfb990f9
SHA512 9ff30cb5c48830f1ad978fc92b39fa6cc42d5a7e6121e2ca9778634d71894de49c82b141cf7c4bcfd696d694b255cb33fd31eed03c3452d84cd3027aa8cb41d1

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-27 17:48

Reported

2024-02-27 17:51

Platform

win10v2004-20240226-en

Max time kernel

159s

Max time network

161s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 5104 created 3372 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (4373) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes system backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe\"" C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe\"" C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-96_altform-colorize.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-60.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\LargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\en-us\View3d\3DViewerProductDescription-universal.xml C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.contrast-white_scale-100.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-200.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fa-IR\View3d\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteWideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\CottonCandy.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64 C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorWideTile.contrast-white_scale-125.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\hand.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Assets\PackageLogo.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CalibriL.ttf C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.altform-unplated_targetsize-16.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-200.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ug.txt C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\accessibilitychecker\styles.css C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\1113_20x20x32.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSplashLogo.scale-300.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-48_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\MoviesAnywhereLogoWithTextLight.scale-200.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sq-AL\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square150x150\PaintMedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-150_contrast-white.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\StopwatchWideTile.contrast-black_scale-200.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailSmallTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOneNote.nrr C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-96_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-24_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockSmallTile.contrast-white_scale-125.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-256.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-16.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\animations\OneNoteFRE_Welcome.mp4 C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-96_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LibrarySquare150x150Logo.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl C:\Windows\system32\wbadmin.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5104 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 3628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2408 wrote to memory of 3628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 5104 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 1096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2956 wrote to memory of 1096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1096 wrote to memory of 1092 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1096 wrote to memory of 1092 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 5104 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2692 wrote to memory of 920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 920 wrote to memory of 4044 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 920 wrote to memory of 4044 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 5104 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 4928 wrote to memory of 3580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4928 wrote to memory of 3580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3580 wrote to memory of 1396 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3580 wrote to memory of 1396 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 5104 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 3728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1580 wrote to memory of 3728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3728 wrote to memory of 4896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3728 wrote to memory of 4896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 5104 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 1240 wrote to memory of 2348 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1240 wrote to memory of 2348 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 5104 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 2160 wrote to memory of 3952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2160 wrote to memory of 3952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3952 wrote to memory of 4328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3952 wrote to memory of 4328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 5104 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 3680 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3680 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2596 wrote to memory of 4672 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2596 wrote to memory of 4672 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 5104 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\SysWOW64\cmd.exe
PID 1728 wrote to memory of 3692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 3692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3692 wrote to memory of 1096 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3692 wrote to memory of 1096 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 5104 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\system32\net1.exe
PID 5104 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\system32\net1.exe
PID 5104 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe C:\Windows\system32\net1.exe
PID 2956 wrote to memory of 4596 N/A C:\Windows\system32\net1.exe C:\Windows\system32\cmd.exe
PID 2956 wrote to memory of 4596 N/A C:\Windows\system32\net1.exe C:\Windows\system32\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe

"C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill \"SQL\"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill \"SQL\"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe

\\?\C:\Users\Admin\AppData\Local\Temp\951facf3f3ef6f6163aa87383953132563d8ef1508b60cb130b1b7d5b96552aa.exe -network

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c pause

C:\Windows\System32\sihclient.exe

C:\Windows\System32\sihclient.exe /cv 63aft7S5gEy89N64R+gU1A.0.1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 203.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
GB 172.217.169.74:443 tcp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 171.117.168.52.in-addr.arpa udp

Files

C:\odt\HOW_TO_BACK_FILES.html

MD5 25bd57fa32c3a840896114bfa114ff28
SHA1 537335ee01b89cc6230e6390b1e9991c1ac8e687
SHA256 67b77daba2e55b7d2aab5462f73e50e9a7c9adba1cc83e35bc19cb064f09818a
SHA512 7f3cce56d33e1ac0d4aa67f2caf910e8956aec61674dcde07bb593e9250b3ba1d646093c5fbd955ba23e4bcbf5fa1a0bd4d901e77aef446f7175d16170fc4df3

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif

MD5 8f9ad7006348369e95d55c2a8f03ac47
SHA1 4d97c3c6fa0943e18ef83bd0194a3c44e083ceb4
SHA256 afd543099991bd573b4f7b1aad2a369bc3888b81c615da8f962130b2c73092d7
SHA512 dcfeac172fc7337335bd9f093e0ca31ad37ca310162bf089c4bc8133cb9bc6391926add06c2c3e94cd9ab1546b95f383946c04a5830e2775f1bc5bcc34d3e22c

C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 92dac97e0d4c9d1369bb05834ff4409d
SHA1 46b4dcf958b0183b9a1345c0964963a1ee6c19a1
SHA256 1610674be115620361691999d9838950b1e539e81a686311ab73dca407cffd34
SHA512 e1cc6a6e9cab76e6e2923668adcccab00486801881136dafa8450826d0d291790c550223ab4c121e1d4f9244897c843534d45579a125e5d53b92600f64eee4d6

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 b40771faa6c1cfefac6448d97d61a5d1
SHA1 f5b3be7bde83813b665996b582f8e57ba651c390
SHA256 193cf608ae87b32c01d6070dfea5f4b2a6fefa984b9c0e8c040f5407858896cd
SHA512 3a7b178323674b766a2e9fcadb532d142e1d82953d3222e4770ded7466b0af5ef0f87667f69e7429e4ea3d1d7fa9a5b36f6b24330955fa5db317720a44b9366a

C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK

MD5 391f64a7373cf779c11ac2c976e045a1
SHA1 a220791fdba7f855d86e0210a620c5a3cfd27aaf
SHA256 a050fc97ab449c60ef7403a0ee2a9b323eb925c8062e3d49480c23216ed09e1d
SHA512 656d137b0027f27ea7b7f7f1923b2c8be2c168cfa3e640a0638e96e0fbfc55ad179a5877a2d569fdc3eec04d583d0d8f2eda0bcd48abb6f63ed1c6c182e7166a

C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK

MD5 27afd7e45fda2b16eb067c2577885eee
SHA1 0f3a8fd5d5db3ed4a6fbd1695273f63c4c69063d
SHA256 fff064e5a1a0337d61634c780334a560da313c1c07dcad0161fd2f75a14ceeb0
SHA512 2c6378387e2bf82871411dff747e0c741a07d10ea08d83e8ccac8d9ede9f1d0666acaf769116e75b196d438df8c3180c6dc5cb84db7d72e422efb77e694bf0ad

C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK

MD5 e8f499a9baac810df03c3ea61c718c5b
SHA1 adb9bdb3a4d503e232b3c840fb3dee2615dfe8d1
SHA256 832ea6c00a381442f71589011c7fed5e7116ba2c4677d14f56a93348f1f7278c
SHA512 9aa5e3c6acca8e50996217105970bb90b6011bdddc0bee1f02d955beee9876eac71e68c96a0cc142c16eb4c03497b653d1e63f020b9c45a30ca5ecdb47bdf3fc

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config

MD5 aab8c424760ca61d8ca396303f6447c5
SHA1 8471e3ba6e0c75d5f9613f36ce8f8e28acad9496
SHA256 15d1f372e186559cc938c703a6147edd6e7b16072951242806675709f1ac972e
SHA512 9f1bc5104d863128ea61e1ed76d15884e34c71718326717fd8c6136df5f45dae0ff1d1aeacce15b8f2a42afb4a424d65e1abbf9c5f225826cf1c3618a8381f87

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL

MD5 57ea12e4e164ee4cbc1232fc0e1cb6e1
SHA1 fcb6d4b52da98ac3b49287131392b4d7b67b6e75
SHA256 b5371e07b92f2cf0f0eb5a615485d97a68c5ed8b7eb2ea74ed69c3edb7268607
SHA512 e280d7449b6ea4400641dab25e377a3570c99b4a8837ce2dbbd2ce95a9c48111308e415c1734fca375f083ac96c796d6ca70bf04104e80f98cddec958a840afc

C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub.locknet

MD5 ce6f7a2c963d93f6cf284ef5621d5905
SHA1 8ca5325fdfdaad178151f72f8a7921337cc9e4c6
SHA256 5df7c593b2a2ba515132d709dca53545e35b6e04032acb53304625a4d8402de2
SHA512 b9fff636dd9601457b8a5fea8722d07be5e2b78b9ade9695a16bbfa2047f82b72ed5c2a243a4dc206aae74bfc3b9eb30230eac8edd95559d7b4ed45e19cccf18

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia32.msi

MD5 32f1c9cf35d1dac1de56a21cff0a4bcb
SHA1 ad6850eacb713bfda0c5e335701136ad1370e7c9
SHA256 7f75717884396ce60b1c1f03fdd2354c2d0538a9f3f414467b65c3bba14d4390
SHA512 6528f169473b43119aff879457c32abc539dc4eef3c511274be92b907793cc0bdd37197bc25444f13596288a0bc9e27f0ff02d580a6a5231ccc5fc1774e57a91

C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo

MD5 68cb5bef2cd98cb640761e99225609ac
SHA1 9bfac83d0b4fba29f23bd552bb62d4d21c4415d5
SHA256 a3322c53a145519d0c8104d370fa6dd1d563c3c9ae4a44085af94a5b51107da9
SHA512 b655882ee595a564ed866631422a2c39064ad9115fb15295f4cbea86d8de723588233dc122d283011c544d22de4f60b537afc7d21e5f8b294ae3287fd89e4513

C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo

MD5 6ce94193e594c328c7bcd2a2e27e0335
SHA1 86fa6f79e8d914cdc0474f8955b1870796882651
SHA256 5369f6488a527aa7bf2d12a448956687bfce8d4243eb54adcfee4003e6a682cc
SHA512 72aff872ff36ebbc1a06996812567cfb269a8ec5107b50ce8566c29457aa28a64da53a28c0b38907bc4584b0ad5b1b1ae798db50e1a74c599bc61b7a492ed5c4

C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo

MD5 665829a15c1545b6d53e609b8ef2437c
SHA1 aa365f292ec4fa9c8444ef7880b98b777101c474
SHA256 f630de8d6fd564e0158baef925405e8921caf4e835407135d54aa46c98b76229
SHA512 384cf9988ca1dd2b3a6c21519f32f1dd15cca59e857881e59415e0163ca87e7491b8b6a33bd331ee55e56bddc2ba095d335b1e4c4023f654727c73fed29de262

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak

MD5 84bf6c372f5bfeb4b7aa3fbcaad39c9e
SHA1 88926bf509cb1944e49fdee7eaf6673a72f5846f
SHA256 97a5c440cb31fde94c0732d8327f15d14f5f56989759cf0100df532af7da9594
SHA512 7a93865fcaaef4a99ad97648b1e77a8e0a56d2d3fbdf15dcc46b483778d2c6c9ae691bb602b00b35c3cb97cc224718b6715cc84bd40527f1b7c9eb2f709221a4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png

MD5 9d425ad69362e9794060e672a5602fff
SHA1 0eafc0a8fd92cf32c49c70e9751eca56b82b5905
SHA256 29bd2918ab92bb4bef00197b17168b6653ab3c6433f6fcf37dcddb0c65132b09
SHA512 d2e57d7d43ac01d132413f46ef3aa72c2747b3dcba469b12fd10c24836f65f74ce6e256a7f7eb6ce4db260dbae1414f4955f27d8c7388bc89405462ffdeb42bf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\selection-actions2x.png

MD5 ea734a564acf820ead97465b7a032def
SHA1 b9a5c428b9d680b11dc021345a62cc81ae99b0c6
SHA256 eebca4b1b4cf68c8fcc626ec06a1a52dd68b69ea43dc69b2a42f4b5b83e8cb1b
SHA512 f62f7b06a27c5a83971a40579208e0a53d88db935a931f9fdbbfd52c38cf9266d6814a73f06d3e447048cb7e99cdcea3cca5f1dc6874e7a163b7e6bb9444529a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

MD5 94dcf2c78d2d20c46ca99c8987f1bab9
SHA1 b2c7e607396f5e59ae121590e2b209b6ecde4651
SHA256 fe1e63b1ce37ba31bdf5c4aadd740f929266a09a4840916472ed5cb6f7c9ad73
SHA512 33983a8bc5d0acf865a30e4eddb94eb297ebee9878412659ff2a0f1e1c4b57781992b279710235ad6623fe155b197f127cc801e426aba5dd46122fa16682d602

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reject_18.svg

MD5 3b34ab4ec1eeaa9dd921587cc30c8e20
SHA1 085524e9cc95e17b4a336a8c488f58764bddf80b
SHA256 6eef018e26263fed11f154e7e0c15351b0ff891b12f9f9ef631cd994a01bf3e0
SHA512 d6d6dfd40bee44d919aae8efd71ab379dd62c7b17e935afcc81819cbd810c80dc044a71ff5485e9f5e29642ce858fb5341c52ca6bcba8740f2816f80c3b36094

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js

MD5 7cbfad364a4a3fd66b8801f73cc2991c
SHA1 f6a9916bb94b3d69fd2322144b498eb57f36cb6e
SHA256 7c87665ae1003774ea3b8264f583d182cccbd6c7e35b36a8beb31c6925c6b705
SHA512 8cfb857603625e39d82f63e506aaacf1019bf67b60bad02aed4bbd7afd25e66de2f3f741a6ad7e096dfad3c41a78ca8bf9980400010debbd2914714d824eeafb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js

MD5 387f62e298e7e3a0d7918a27f9e8a34e
SHA1 84b20fabb0260c3542ca0463bbb9b9f47318ae4c
SHA256 1f1231d64d3837d36d2b21e2a799e7de494202a6a5315f217c6ec6d8fe134b4a
SHA512 f1db345204609d39e9be71a128a806142433493f7c83c36fbe321d12685889233e964f4203de18ca69fea98bde507361cc4e050c7406088742d96f4052c11de7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js

MD5 5b0c36bd85368e1c8a1189ef05642622
SHA1 7bc81ad9dafca72afdb13d80cb3760fa98df7ebf
SHA256 3af22f2b484246df816c8a0e9d5678258534913b3fda81feee9e082e4eaa35a7
SHA512 181433bb8142bf70552012623de9d1f292f1f07356a5bd626b6a89784e55cfae7f96628f403520101e8c619f324c0f4fed29bce6ab2b0b0051df5d48b9746b42

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js

MD5 dc89e6f408d7a77a08734ea0e1b494c2
SHA1 031002742307f5766605128349035d26bd0323b1
SHA256 31ae0f8ddc341b0507e3e382ccc825461ea1a3fd8e0a624f795196ada1866a8b
SHA512 0d795707a438fe92516b0657f91953c44311f7a3bf0e58057c4e632e0fd39e339a9d9dc5318045ae4caa6f6009d9c9d622e442666e71e9388bad6963894259d4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js.locknet

MD5 4ac7bd723de787eac5d0d07dfff28c15
SHA1 566ac124126c6ec7aad76485437256c6e2ef00c8
SHA256 145a6ba07e91fc9e196170d478f99f2092b529627952d8d6e576a9a1dce2e8d8
SHA512 21c291146d3f8e7934687e788657a93e8fcbfa34ca7ab503175533dae227936ea07e7f2cee541439db6cb4ef6b9394df6748cc7a44a94ac4ad2146d9761b6194

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-selector.js

MD5 d9ed1af3fbb0cdc10245a52617a9aa38
SHA1 ab1eea57367b1aba75e3d33a64babd418a079fdd
SHA256 5296245319d8be0109d267fbca3712d1d76bb77ae4b67ec6803c9e93cfd0b64f
SHA512 f4c0cacb8bebb00f64a1c817244cdd68c0af1c15b5a09e0e927d5cf5dbfb2dc3cd64f1d4453164e4d359a2863cf2b5dc023c4149058a67b1b7d95bbb8dd5ce51

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js

MD5 7ba37a97b65ef185a61191baf7cb5631
SHA1 c1c4906073ad3754fb262f159e37ad21b14d59bc
SHA256 9fe61368fc5956803589b28194ad0464d85c31f5e19011bd0eb9c0c3a6d6a0d5
SHA512 69e8e6bedcd78a21d1a7d6f0008f73fe02ebcac1217ab6caad3bcf5ab2499b2807095424206680395b6dcccef2b92c9b571f18e9603b75a34120be6c248d5601

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 97539327533404a55cc9f2f5e4b98c21
SHA1 54e8b8de22e2d7b5d477bf65237b704c4af1114f
SHA256 ca333fcde20ac1b5ffa36d3eaaea5e371f1d1ada87150ceb2529606b08d7ca43
SHA512 452dfe1f59db9a77e57dc1ab82f78b32155ae083b92291c14cc97b8cd70f33ce7196a406226753f73914a225e9bd92b5b517b24d2d6dd2226ed9157bd0b95c62

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 145f077cbbe8cd523a205d8ca5195281
SHA1 0786310d456e133b05194b28ca24ff5e4c1c772a
SHA256 c276fa7f3cf3687cfae14e76d25df5d579fe5411067ec46a205e34a8bc012455
SHA512 318125dce4a36889c055beabaa1fe1d449a9bae482a749dfe1b57f28515c849e69b86fc3568ed4b4478158e82325a7bd9792ce7457bedab96f98d5a7a1b99fd7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 4fb8384a58d283ce1965d5b953c03343
SHA1 5c000526f858830c2417d0da78a7974139462288
SHA256 49c3fd1465f1b9d779b3d7f097e50d7ce92d4f5c85500d8bb2d6e501aa009331
SHA512 5a2468d9e0e04d5eec81abb097a3f9ac84558a5e5d3dcdac98e8dafba44b4bf9b9588e707d082bef1372b138462300b16a8c975da0054cdca707789370292cdf