dfaf0e2e1c579d5a136e3b83da28d6ecfe9eec95030fe4a9918c779776f51e4e

Analysis

user interaction
yes
max time kernel
359s
max time network
348s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
encryptor.exe
Size 5.9MB
Sample260930-xd9kwazbjd
SHA256 dfaf0e2e1c579d5a136e3b83da28d6ecfe9eec95030fe4a9918c779776f51e4e
MD5 2da9891d978ade2f63782a080b252606
SHA1 d55ea9133e1a13b66899a4a119996ee0cb86ce0d
SHA512 4291a57458528d97bf4fbbca93acb41454f8af273dca169c137777205541435503bebd7db1689fd3878a6a05e4ff3ba759e4db9107e9a2baaa6c24340237da20
SSDEEP 49152:GUmbbbCVIdGSOU0FiUX5EVG60Dd5Pnf4Imug2DVOnX6IxBjlorHFqMY50O8U6IU+:VPF/PvfkuUxBS7Ay2t+st9iOFnKJGv
TLSH
T155568E43F25254DDC21BD539C2A67637B33679892131AFBB1EC89F356E22AC48B1D318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery ransomware spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\gmreadme.txt.locked	encryptor.exe
File opened for modification	C:\Windows\System32\drivers\gmreadme.txt.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt.locked	encryptor.exe
File opened for modification	C:\Windows\System32\drivers\gmreadme.txt.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt.locked	encryptor.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:\	encryptor.exe
File opened (read-only)	\??\V:\	encryptor.exe
File opened (read-only)	\??\H:\	encryptor.exe
File opened (read-only)	\??\L:\	encryptor.exe
File opened (read-only)	\??\G:\	encryptor.exe
File opened (read-only)	\??\U:\	encryptor.exe
File opened (read-only)	\??\N:\	encryptor.exe
	\??\F:\	encryptor.exe
File opened (read-only)	\??\D:\	encryptor.exe
File opened (read-only)	\??\W:\	encryptor.exe
File opened (read-only)	\??\F:\	encryptor.exe
File opened (read-only)	\??\R:\	encryptor.exe
File opened (read-only)	\??\J:\	encryptor.exe
File opened (read-only)	\??\P:\	encryptor.exe
File opened (read-only)	\??\H:\	encryptor.exe
File opened (read-only)	\??\I:\	encryptor.exe
File opened (read-only)	\??\K:\	encryptor.exe
File opened (read-only)	\??\O:\	encryptor.exe
File opened (read-only)	\??\O:\	encryptor.exe
File opened (read-only)	\??\S:\	encryptor.exe
File opened (read-only)	\??\V:\	encryptor.exe
	\??\F:\	encryptor.exe
File opened (read-only)	\??\R:\	encryptor.exe
File opened (read-only)	\??\S:\	encryptor.exe
File opened (read-only)	\??\T:\	encryptor.exe
File opened (read-only)	\??\N:\	encryptor.exe
File opened (read-only)	\??\F:\	encryptor.exe
File opened (read-only)	\??\G:\	encryptor.exe
File opened (read-only)	\??\U:\	encryptor.exe
File opened (read-only)	\??\X:\	encryptor.exe
File opened (read-only)	\??\M:\	encryptor.exe
File opened (read-only)	\??\O:\	encryptor.exe
File opened (read-only)	\??\P:\	encryptor.exe
File opened (read-only)	\??\E:\	encryptor.exe
File opened (read-only)	\??\P:\	encryptor.exe
File opened (read-only)	\??\K:\	encryptor.exe
File opened (read-only)	\??\E:\	encryptor.exe
File opened (read-only)	\??\Q:\	encryptor.exe
File opened (read-only)	\??\Y:\	encryptor.exe
File opened (read-only)	\??\L:\	encryptor.exe
File opened (read-only)	\??\R:\	encryptor.exe
File opened (read-only)	\??\X:\	encryptor.exe
File opened (read-only)	\??\Y:\	encryptor.exe
File opened (read-only)	\??\Z:\	encryptor.exe
File opened (read-only)	\??\Y:\	encryptor.exe
File opened (read-only)	\??\I:\	encryptor.exe
File opened (read-only)	\??\T:\	encryptor.exe
File opened (read-only)	\??\I:\	encryptor.exe
File opened (read-only)	\??\W:\	encryptor.exe
File opened (read-only)	\??\Z:\	encryptor.exe
File opened (read-only)	\??\D:\	encryptor.exe
File opened (read-only)	\??\X:\	encryptor.exe
File opened (read-only)	\??\J:\	encryptor.exe
File opened (read-only)	\??\E:\	encryptor.exe
File opened (read-only)	\??\F:\	encryptor.exe
File opened (read-only)	\??\K:\	encryptor.exe
File opened (read-only)	\??\M:\	encryptor.exe
File opened (read-only)	\??\W:\	encryptor.exe
File opened (read-only)	\??\M:\	encryptor.exe
File opened (read-only)	\??\G:\	encryptor.exe
File opened (read-only)	\??\Q:\	encryptor.exe
File opened (read-only)	\??\J:\	encryptor.exe
	\??\F:\	encryptor.exe
File opened (read-only)	\??\D:\	encryptor.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\fr-FR\Licenses\Volume\Professional\license.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\System32\MediaSystemToastIcon.png.locked	encryptor.exe
File opened for modification	C:\Windows\System32\NdfEventView.xml.locked	encryptor.exe
File opened for modification	C:\Windows\System32\PerceptionSimulation\Assets\OpenHand.png.locked	encryptor.exe
File opened for modification	C:\Windows\System32\uk-UA\Licenses\_Default\Professional\license.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\System32\spool\tools\Microsoft Print To PDF\MPDW_devmode_map.xml.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png.locked	encryptor.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_8bc1bda6cf47380c\MXDW-pipelineconfig.xml.locked	encryptor.exe
File opened for modification	C:\Windows\System32\Speech_OneCore\common\it-IT\Tokens_SR_it-IT-N.xml.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\MixedRealityRuntime.json.locked	encryptor.exe
File opened for modification	C:\Windows\System32\@StorageSenseToastIcon.png.locked	encryptor.exe
File opened for modification	C:\Windows\System32\RemoteSystemToastIcon.png.locked	encryptor.exe
File opened for modification	C:\Windows\System32\SystemResetPlatform\SystemResetPlugins.xml.locked	encryptor.exe
File opened for modification	C:\Windows\System32\uk-UA\lipeula.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\System32\@windows-hello-V4.1.gif.locked	encryptor.exe
File opened for modification	C:\Windows\System32\MailContactsCalendarSync\LiveDomainList.txt.locked	encryptor.exe
File opened for modification	C:\Windows\System32\NarratorControlTemplates.xml.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\Speech_OneCore\Common\it-IT\Tokens_SR_it-IT-N.xml.locked	encryptor.exe
File opened for modification	C:\Windows\System32\oobe\en-US\vofflps.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\lpeula.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\System32\BluetoothSystemToastIcon.png.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\Speech_OneCore\Common\en-US\tokens_TTS_en-US.xml.locked	encryptor.exe
File opened for modification	C:\Windows\System32\oobe\uk-UA\privacy.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\System32\PerceptionSimulation\Assets\OpenHand.png.locked	encryptor.exe
File opened for modification	C:\Windows\System32\uk-UA\Licenses\OEM\Professional\license.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\Licenses\_Default\Professional\license.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\en-US\Licenses\_Default\Professional\license.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\Speech_OneCore\Common\ja-JP\tokens_TTS_ja-JP.xml.locked	encryptor.exe
File opened for modification	C:\Windows\System32\F12\Timeline.cpu.xml.locked	encryptor.exe
File opened for modification	C:\Windows\System32\appraiser\Appraiser_TelemetryRunList.xml.locked	encryptor.exe
File opened for modification	C:\Windows\System32\GameSystemToastIcon.contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Windows\System32\Licenses\neutral\_Default\Professional\de-license.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\System32\Speech_OneCore\common\de-DE\Tokens_VoiceActivation_de-DE.xml.locked	encryptor.exe
File opened for modification	C:\Windows\System32\ja-jp\lipeula.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\System32\Recovery\ReAgent.xml.locked	encryptor.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\default.help.txt.locked	encryptor.exe
File opened for modification	C:\Windows\System32\spool\tools\Microsoft Print To PDF\MPDW-pipelineconfig.xml.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\Licenses\OEM\Professional\license.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\System32\HandwritingSystemToastIcon.png.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\Licenses\_Default\Professional\license.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\System32\PhoneSystemToastIcon.png.locked	encryptor.exe
File opened for modification	C:\Windows\System32\@edptoastimage.png.locked	encryptor.exe
File opened for modification	C:\Windows\System32\WDI\LogFiles\StartupInfo\S-1-5-21-2091445952-3649787497-104050984-1000_StartupInfo1.xml.locked	encryptor.exe
File opened for modification	C:\Windows\System32\ScheduleTime_80.png.locked	encryptor.exe
File opened for modification	C:\Windows\System32\Speech_OneCore\common\de-DE\Tokens_SR_de-DE-N.xml.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\Speech_OneCore\Common\es-ES\tokens_TTS_es-ES_helena.xml.locked	encryptor.exe
File opened for modification	C:\Windows\System32\en-US\lipeula.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\System32\@windows-hello-V4.1.gif.locked	encryptor.exe
File opened for modification	C:\Windows\System32\InputSystemToastIcon.contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\uk-UA\Licenses\Volume\Professional\license.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\System32\en-US\Licenses\Volume\Professional\license.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\System32\es-ES\Licenses\OEM\Professional\license.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\tcpbidi.xml.locked	encryptor.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_a7412a554c9bc1fd\MPDW-PDC.xml.locked	encryptor.exe
File opened for modification	C:\Windows\System32\IME\IMEJP\APPLETS\IMJPCLST.XML.locked	encryptor.exe
File opened for modification	C:\Windows\System32\HealthSystemToastIcon.contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Windows\System32\ScheduleTime_80.contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\@VpnToastIcon.png.locked	encryptor.exe
File opened for modification	C:\Windows\System32\icsxml\osinfo.xml.locked	encryptor.exe
File opened for modification	C:\Windows\System32\@bitlockertoastimage.png.locked	encryptor.exe
File opened for modification	C:\Windows\System32\HandwritingSystemToastIcon.png.locked	encryptor.exe
File opened for modification	C:\Windows\System32\Sysprep\ActionFiles\Generalize.xml.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\uk-UA\lpeula.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\default.help.txt.locked	encryptor.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-64_altform-unplated_contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\MedTile.scale-200.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\Attribution\foreca.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-64.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\30.jpg.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-48_altform-unplated.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-125_contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageMedTile.scale-150.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-96_altform-lightunplated.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-24.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-125_contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleLargeTile.scale-200.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-unplated_contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSmallTile.scale-200.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\Weather_SplashScreen.scale-100.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageSplashScreen.scale-400.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square310x310Logo.scale-400.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreWideTile.scale-100.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MoviesAnywhereLogoWithTextLight.scale-125.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-200.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\MicrosoftAccount.scale-100.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\Wide310x150Logo.scale-400.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosWideTile.contrast-black_scale-200.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsMedTile.contrast-white_scale-200.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeBadge.scale-125.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\MedTile.scale-200.png.locked	encryptor.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.scale-400.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-200_contrast-black.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\MedTile.scale-200.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxManifest.xml.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-200.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-32_altform-unplated.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16_altform-lightunplated.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\uk-UA\View3d\3DViewerProductDescription-universal.xml.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailBadge.scale-100.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64_altform-colorize.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailBadge.scale-200.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\MedTile.scale-100.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24_altform-unplated.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-400_contrast-black.png.locked	encryptor.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt.locked	encryptor.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\THMBNAIL.PNG.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-125_contrast-black.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\WideTile.scale-100.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreBadgeLogo.scale-200.png.locked	encryptor.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\SwipeTeachingCalloutArchiveImage.layoutdir-LTR.gif.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square71x71Logo.scale-125.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-unplated_contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-30_altform-unplated_contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailSmallTile.scale-200.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-64.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\AppxManifest.xml.locked	encryptor.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-200_contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-20_altform-unplated.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-24_altform-unplated.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-96_altform-unplated_contrast-black_devicefamily-colorfulunplated.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeLargeTile.scale-400.png.locked	encryptor.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailWideTile.scale-400.png.locked	encryptor.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\NewWindowIcon.scale-150.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..talcontrolssettings_31bf3856ad364e35_10.0.19041.964_none_d1ce1ea46e50a943\n\MicrosoftFamily.scale-200_contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.19041.746_none_0119299746221375\Logo.scale-100.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\TileSmall.contrast-white_scale-125.png.locked	encryptor.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\BadgeLogo.contrast-white_scale-100.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\square44x44logo.scale-400_contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\BadgeLogo.contrast-white_scale-100.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.746_none_2b9acc2d69574796\TabletMode.scale-400.png.locked	encryptor.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\Assets\Folder_Large.scale-100.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\x86_microsoft-windows-l..volume-professional_31bf3856ad364e35_10.0.19041.1288_none_405c4314f359009b\license.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSplashScreen.scale-100.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars38.contrast-white_scale-200.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-l..volume-professional_31bf3856ad364e35_10.0.19041.1288_none_9c7ade98abb671d1\license.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.19041.746_none_afaafac6b02c16fa\ja-jp-sym.xml.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\ResetDriveSquare44x44Logo.scale-100.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..l-wallpaper-windows_31bf3856ad364e35_10.0.19041.1_none_910333b84fcf455a\img0_768x1366.jpg.locked	encryptor.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\perftools\images\i_usermark.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\n\privacy-icon.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSplashScreen.scale-150.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..iencehost.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_52fbb1b86a870614\f\AppxManifest.xml.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.19041.746_none_afaafac6b02c16fa\zh-phonetic.xml.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-bits-client-core_31bf3856ad364e35_10.0.19041.153_none_04304b75e9b1037f\315818c03ccc2b10070df2d4ebd09eb6c4c66e58.xml.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-netfx3-core_31bf3856ad364e35_10.0.19041.1_none_1d91dc8d797e6bdb\FrameworkList.xml.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\ScreenClipping\ScreenClipping\Assets\Square150x150Logo.scale-200.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars37.contrast-white_scale-200.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleLogo.targetsize-72_altform-unplated_contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\TileSmall.contrast-white_scale-400.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\wow64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_ja-jp_afb5d1f043634aff\SqlPersistenceProviderLogic.sql.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\x86_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_10.0.19041.1_none_9f52886e7ba2c371\UninstallPersistSqlState.sql.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\TileSmall.scale-150.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleLogo.scale-100_contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare150x150Logo.scale-150_contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\Square44x44Logo.scale-200.png.locked	encryptor.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.Shell\Images\RequestedDownloadsCloudIcon.contrast-black_scale-150.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\wide.Contact.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square150x150Logo.contrast-white_scale-400.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx4-aspnet_webadmin_images_b03f5f7f11d50a3a_4.0.15805.0_none_3303de6fba37b5c7\alert_sml.gif.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\HvsiUserPolicies_ContainerCreate.xml.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\DefenderAppSplashScreen.scale-400.png.locked	encryptor.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\header\Images\headerclose.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars40.scale-200.png.locked	encryptor.exe
File opened for modification	C:\Windows\Web\Wallpaper\Theme2\img12.jpg.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_39a4d63e07cea862\f\AppxBlockMap.xml.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\htmlfileicon.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\NewWindowIcon.scale-200_contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.906_none_a6600355b5f69459\Answer.scale-400.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\Assets\Square150x150Logo.scale-200.png.locked	encryptor.exe
File opened for modification	C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-48_altform-unplated_contrast-black.png.locked	encryptor.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-white\SmallTile.scale-125.png.locked	encryptor.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\SIMLockToast.scale-100_contrast-white.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..trolpanel.appxsetup_31bf3856ad364e35_10.0.19041.1_none_13506cbfd4a8499f\appxblockmap.xml.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\Square44x44Logo.targetsize-96.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\tokens_ptBR.xml.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\Square150x150Logo.contrast-black_scale-125.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.19041.1165_none_a82485b8f343811f\f\ceb497ee0184aaa4681d2fb2ef242a5b8551eea8.xml.locked	encryptor.exe
File opened for modification	C:\Windows\servicing\Sessions\31277571_3776505411.back.xml.locked	encryptor.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\debugger\LanguageService\images\debuggerclose.png.locked	encryptor.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-256_altform-unplated_contrast-black.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fax-common_31bf3856ad364e35_10.0.19041.1_none_c1f5bc6ceffe0e16\WelcomeScan.jpg.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\SplashScreen.contrast-white_scale-100.png.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\ipsid.xml.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-editions-professional_31bf3856ad364e35_10.0.19041.1288_none_51444fcfcf940a66\ProfessionalEducationEdition.xml.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-l..efault-professional_31bf3856ad364e35_10.0.19041.1288_none_0fb30e7d925e4d06\r\de-license.rtf.locked	encryptor.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars36.contrast-black_scale-200.png.locked	encryptor.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4756	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2912	OpenWith.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5736	gui.exe
4504	gui.exe
2132	gui.exe
5412	gui.exe
748	gui.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 2132	3208	encryptor.exe	118
PID 4332 wrote to memory of 5412	4332	encryptor.exe	119
PID 5420 wrote to memory of 748	5420	encryptor.exe	132
PID 2912 wrote to memory of 4756	2912	OpenWith.exe	134

C:\Users\Admin\AppData\Local\Temp\encryptor.exe
"C:\Users\Admin\AppData\Local\Temp\encryptor.exe"
1⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Users\Admin\AppData\Local\Temp\gui.exe
  "C:\Users\Admin\AppData\Local\Temp\gui.exe" --uuid 04dfd859-6576-4c15-a23a-a38f51aca091
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:2132

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5232

C:\Users\Admin\AppData\Local\Temp\encryptor.exe
"C:\Users\Admin\AppData\Local\Temp\encryptor.exe"
1⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Users\Admin\AppData\Local\Temp\gui.exe
  "C:\Users\Admin\AppData\Local\Temp\gui.exe" --uuid a1828447-8fd4-4019-9b97-6e86108ddec0
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:5412

C:\Users\Admin\AppData\Local\Temp\gui.exe
"C:\Users\Admin\AppData\Local\Temp\gui.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:5736

C:\Users\Admin\AppData\Local\Temp\gui.exe
"C:\Users\Admin\AppData\Local\Temp\gui.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4504

C:\Users\Admin\AppData\Local\Temp\encryptor.exe
"C:\Users\Admin\AppData\Local\Temp\encryptor.exe"
1⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5420
- C:\Users\Admin\AppData\Local\Temp\gui.exe
  "C:\Users\Admin\AppData\Local\Temp\gui.exe" --uuid 4532e81e-f37a-4ca1-b262-865999575d43
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:748

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVER_FILES.txt.locked
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4756

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVER_FILES (2).txt
1⤵
PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Alphabet.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.locked
Size 772KB
SHA256 ab0c0b914ad3e94863e6d33da2a0d23e1025999e1918926e3a135675e603a55b
MD5 eff8e3b3298f0795257a8b159272d225
SHA1 6018ff1775ccbd302ba9472a9b4a7a3c2aaab8df
SHA512 343b3c4ec14dadb0667bbdafb018be906348f913bd47b90a15a52d33f58e8511a7d4c1cf68cf8b497920d23195515be4b7c6cc4f26d80c245aee54dd2696044b
SSDEEP 24576:46RMj+u/Hio7ZI8dNYmvNAG9UeDk4AJ2Fd4:46YTsmNAG9sr
TLSH
T130F433B8AE73CEC78AD053C3A55E9297FBD0B62599811C287B420D70F50ED20DED666C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Content.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\Content.xml.locked
Size 26KB
SHA256 e4c1d54bbd2efd4ec2ae42a21d8816e44f470b5d1a47543f96bdf99199d131e8
MD5 cd8f66c7eac88449472cd52cb2484c01
SHA1 03976d56d7caf7617f61189f7e58ff70c5206bfb
SHA512 c09d559b5d2006770d797cda3e7f54589f0a470915196f9b84ffeee8a7158236227c71e20b433e254e8336bcce59c2f890a42367154ebe2e2269cf5be6b60042
SSDEEP 768:L917mrvTYoirk4tGbgtopukqUe47zbp3w1tJDp:L91Yirdt6gtM7z1MbV
TLSH
T1BAC2F12C7747FE917013D090CEB5AAB7098B8CEF006066661FB2F9B2467DF462317255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auxpad.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.locked
Size 290B
SHA256 70e64b627f44a398415ea360a0281d73c3186d5f82852acbe18dd25ceaa86f6d
MD5 6683548279f764cc48bce252bf62b376
SHA1 08770ddab12db4127237edbbada55c7546105b58
SHA512 bb1d9a91ec200c3bb59b3ef4c1e033e3d0a8ae1a25686d665b35af4bda493cbe940edad3137ba83790f8434539239fa634a3582b09635eb95e3a63b4a21eaabb
TLSH
T1F5D0E71F285373F0940588784C5A00194FE627741642D53D8B74684B2F10DD1B061D93
MD5 SHA1 SHA512 TLSH

Submit Download

auxbase.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.locked
Size 1KB
SHA256 a6e68d078b8cd0c674f5febb84b91bfc64718b69c6504936906e63266e5a8caa
MD5 472bd9134fe5465bb576a1ace7c30635
SHA1 85448c920589f82ac526a2f73398902a931f569d
SHA512 76a1a4037d4d97e1ff0342d4d79741ec5e3c195575da212190a7f0c8039d4df9d12d7d701f2ef0fe1b80186fd839315a79a4513b1e5ed72272792d6b50c07ba5
TLSH
T1B231F96E5BEA12BB83B7413D75B697830E4048DA01C8F61D77CE0BED5791132AA40578
MD5 SHA1 SHA512 TLSH

Submit Download

insert.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.locked
Size 293B
SHA256 7f34fa7c47f986475445bdeee3636d5e263f61969ce4e2fc03c36f1a0289e3a3
MD5 4f95fd9c43513962dca6aba6208296ec
SHA1 46a083fb39879989133951f63594cfb4aff41cff
SHA512 8450fcb80bee1bfdd2f77e989b430a3a8112a385f7ade39b5c21d518c59fcd07fcd735e5b5518bafd21167b7fb39cbba792cb25647ce271db2c0b67cd5e95fd5
TLSH
T18AE0E729570FF49F053BFA34C45C1056386D3AE349C520254550B88E4C328FC5805517
MD5 SHA1 SHA512 TLSH

Submit Download

insertbase.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.locked
Size 981B
SHA256 b492b8886c250a1d52da7ffe9c53b0788d7b23c6b61f923b00efcb93ef7babee
MD5 64061d1d640753b65ad10a710609ab19
SHA1 8a4a3fd089bc9be6e6f267bf113267c4bb8ee1e6
SHA512 b6a650bc110e8eb63ee1a219ceeeabc4a24f71f6e54c3cebb2d22cd2ed729359361b0f5399a90b698ffc9ce8333d60b89d59b7fc601abf37f3a8eb1678fc5dae
TLSH
T1AC11650DAB6030F21C4CF94EC24CCB6C4F7D096C566B5E6F09019D1AE530CE943B9651
MD5 SHA1 SHA512 TLSH

Submit Download

keypad.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.locked
Size 771B
SHA256 2a3968c04ffaeec1d475fb0735ee54c1fe1013a09684a5280c7dc3810eca2937
MD5 454bd79943641460fb29fd567269b4a7
SHA1 b48f9c233a4edf0cb8f1123ce8cc30c19c072832
SHA512 06bf93af672508fac38d46c2d88f469551e76360730e4e549ec9706dce17251a6d66d62065c11b12510f25d5c11ce5abe99d39d6c91dc0bd9c702d540284bc75
TLSH
T130017524437BF7E6D27018680AD7E0053A72976DC5732DF68C7D09E416C0D54AB799D0
MD5 SHA1 SHA512 TLSH

Submit Download

ea.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.locked
Size 462B
SHA256 898ece6ff5f7b754d5cc2e80aa24469cc390c7fcb0d4be28ffa373e2a3425c26
MD5 c23462d86987949b11cb69d326cab625
SHA1 85f365192b5dc85af045bef7809803d20ed1d06c
SHA512 32a12fc96be444f5f61007dd862c3b0c3e334b3a1cfa16fa3c7681b0f61771ee893a438f9f05cfafdc17426baf2f541bbeea1f0ef65d5380d378ad37716e3e8f
TLSH
T188F0DC9385EB9086E1287234D60A382119B13E0503D92137FE13C04F2984FE90091B8E
MD5 SHA1 SHA512 TLSH

Submit Download

keypadbase.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.locked
Size 981B
SHA256 3bb98100162769b32169760e0abfe413b4f28271b9dc0004f361f867296ef92e
MD5 537461eb31a203f2442f518f6c59c92d
SHA1 34d08629a12fdf8858aa829c2f691fa46c29bdae
SHA512 80924e923f42e0c2d53a164cad6da7cf356b98ca8e2136b0e3ebca5fb563677af6843718223f49b17c1ce83dcd0956781e5f890466d947324ab8543045ca09ca
TLSH
T1BD110837023410ADBA8F8A6E68C85C03F82004D16A25B3B851D187EA0B686DA8D1041D
MD5 SHA1 SHA512 TLSH

Submit Download

kor-kor.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.locked
Size 470B
SHA256 c67f02b3f944ebcaf1a649dc8679a09361b9179f1cac41b1af06cdd8dbc4d558
MD5 c3d48a288cf23073ae589f1a18112186
SHA1 95c5a4f10f54300b01c6c4fcc9caf9ba953acdb8
SHA512 8612029113136c879ae74702e411c10d8e1fadb82d2c3389d120a325b80b3c88cb91ea491906dc2e0e3ad2edfa764c567aa28e48b53dc5f17f2d38ca396ffe9e
TLSH
T12EF0D478B146A6A6834257F0FF14741F4F9E24C28534F1A55A294841CCC8964F122285
MD5 SHA1 SHA512 TLSH

Submit Download

main.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.locked
Size 43KB
SHA256 89f2c56bb6977a04ff8429691ee1c03fe8947ca79c4d02232883d3346a03e0ce
MD5 0354254efbdd66c06a17a685637f5636
SHA1 1112f17f7d1b1b239be672b18bd54c73bfc9c7b7
SHA512 d588ca88bb96d6f1e853e07d72b8db550500eb236991aafee4be25bd5da7620f7ef9e612c998cc6b4aeea9fa39e2341caea6537e6bcc4baefb38c2d5af73b851
SSDEEP 768:443SYuhb3Pxl+DcxxPD34PcF1ZOKHdN8Eh6GSGcEf3z+PJ0J73CuJmytHUdB:443Y3PxFxPAcF1ZzHL8Eh6dEfjRSuJnc
TLSH
T15B13F1EC54F56B51FEC9D42F6C70F9312347283DA598E9A98B9FBC49AC38904124B3E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.locked
Size 3KB
SHA256 32c4acb86315257920a06ea84f094331790b83b145de7e6caee4044914bba236
MD5 5dd92b89734c7dd13a20eb1096aa6f2c
SHA1 b311abdc66ac06000a8b5648560bc763196624d5
SHA512 b35b21b3070262c95d05e10a75d27f7217934adfec99bc0d84b087fb2b912d5a4e47f7aaf67d40ea4816ebd2f1127f3fcb0528c0876b71ab05ee1340d201334f
TLSH
T12C616D13FA4EF5C90F39E02B561EED79F6530721B4E0D254B63316C8C90E497E60148B
MD5 SHA1 SHA512 TLSH

Submit Download

baseAltGr_rtl.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.locked
Size 325B
SHA256 cbfde286a9ca24af0a9d1667608fdda18d56fc5f1940afe9b7d2223fd012c0d9
MD5 dd9b459db9ffd69a49b3a250037755f0
SHA1 99f81ad0b8985560085b95e167fdd83b886e1fbd
SHA512 9615ae704c53f7d72261f3485ccd6a5392351560e39f8400670b94d17afe3a8d807ab982cd5c8b178449b446914815b3840f6051dd3ac31b9fda5dd0a68c1cd8
TLSH
T181E02D32CA0384F2C2081A4481C3F8E203614304284F37C4E9A4E8C22A314A62805848
MD5 SHA1 SHA512 TLSH

Submit Download

base_altgr.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.locked
Size 3KB
SHA256 27fde0275278c2972e05702255ef1086a219a265bfc8bd0d55bdf495ad95225b
MD5 1af0b1e200817a03cca370eea4d80a20
SHA1 d7f70b8b1c27fda87e004ff73549271f9f134382
SHA512 4f42f7165cfb07f985b1ff5b5bc80e96da691fa3b9e0bd5310af8e64f59ccd0d66f7a9afda555046f84a5e97520faa46eca6bee7931e35808d1289da6f0defdd
TLSH
T140716BE399A8E8B11D4439F2E08B02DB1C69644148D331AF30817EF00F8EA8C9D8F0E8
MD5 SHA1 SHA512 TLSH

Submit Download

base_ca.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.locked
Size 3KB
SHA256 c28ad92024fad54e2191c5e9be1b3dc0c3fd4e70150c64d19249aa24704feab6
MD5 6138d01b5e1ab783ac15b510200a1f6c
SHA1 d85dcb6cec2d7526ce77bf7d616f89e540fedb9a
SHA512 3a7da4c0176b514ecaabb5f2b37bc7a160875f39358f2291c9766a1a12baaec0dd65d75d38965c3cbee89a786313be3a01d0ea7064716e7b41c0031c5011fa48
TLSH
T10C714C9003DA3B0953AAF662C18074D9A8F6C46806429B2B274F192E2337AE065CDD77
MD5 SHA1 SHA512 TLSH

Submit Download

base_heb.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.locked
Size 816B
SHA256 14dc4da18cb43e94d99dc706c8c52bc88c36e8dd43c5d9a42d748a159fff7547
MD5 ce100378144c80e13274aacba6cd65d6
SHA1 1f5fd4a77817f6eb077b83ac73789d41ceed4f64
SHA512 9c0e9753fc27b1ed157648c3b541093264e48da36b3329b9d9849668df8a3602a9f5dcbd2b259e631e7c7dfdb379b87dfb5dab3e5adf3041a00674a412d72137
TLSH
T1F50186178D09F1E9080030F7F19FB8058DC496AAE8363F4597F5884AA8B8F58611B5C8
MD5 SHA1 SHA512 TLSH

Submit Download

base_jpn.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.locked
Size 882B
SHA256 df694c1e0b7bb33d257687cac0a27b22a218965c2c0dfcf11ce37bd5c8becaff
MD5 56cc7c5650d23c3605203ece9004aed1
SHA1 6ab5e36fb30442a6c0f28dc02bca96a1b951fbed
SHA512 f618e685c0ed7642f5fd5bbf8f5dca263afce47758c67a0f98eb458a37492a0bef32871b00b798757c386a5a6bf2137fb9cee4675ca02a7cf68b729280a65397
TLSH
T1DD11639FE27AD9A91D3B267104DA81F6F91F6AC8B560B2A5666153232B01C0160AC242
MD5 SHA1 SHA512 TLSH

Submit Download

base_kor.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.locked
Size 566B
SHA256 fea68110f75fef5abac4e71864a0868cb8f8a5768b07cfd1f168c43e8687c30c
MD5 2b970e593ce1c0dd3d993d4f4fea7656
SHA1 d1ac5dd69f73ea746130851013e58a8e70e59f72
SHA512 3f43d14cc9abc6638f3927d2ee80e8b676e41f3705488bb57e4519f5c94c95c4b50b77cc50b8e19a80430e3aceac5c41c082cb9636c3f35dbefacd9e8aee5c3a
TLSH
T11AF0962800ED51D347402B28569C566D24B60023280172A522C0C04ADD3DFD35BCE072
MD5 SHA1 SHA512 TLSH

Submit Download

base_rtl.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.locked
Size 695B
SHA256 54ff7c8c7d55774449c39c77244147fd838c36f379f09785bfc70d59e747e4f4
MD5 c4f84f89eccb85de7ce59320e4704956
SHA1 065848189f258a132f26f04ba3333b37035ef193
SHA512 95059a543ad3b77404f78feacd7f5d528f107538611e0dd9587c73893b9605861e2ae2002a218a450749cf15e1fc5a59be43811cbdb30ddb586561ffc44e6570
TLSH
T1B00194C299EB6D90C4C0153C420942D909FE2D87C6003EAABE098A152A7E5A048BFE48
MD5 SHA1 SHA512 TLSH

Submit Download

ja-jp.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.locked
Size 16KB
SHA256 6dc3b314b3508acb3d6f50488c411f187fd478d2ae281190bdb3abd8ed011d01
MD5 4f9202f4ef79274eb582668005ee1b23
SHA1 742fd38eef7c665d3bf2e053e377a5f5892e6e9d
SHA512 846310efdcf6a2849ec3af5ec8dc3e94064052a0f5bf8e48b57994b9b5c338cac907aa3e11188a6a00b7bcb94f9822d355506d9382d051b6790374e17480a9e8
SSDEEP 384:1cG2NFf7JQ+K/a44P3LsrgKwWgY6mivTpb4PfK:1SNvQr/aRP3ortwWgM6B4PfK
TLSH
T1D172C06369A3C8C29677CE392D287E831FC975BD409D24776CFF7F23A19E42564884A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko-kr.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.locked
Size 14KB
SHA256 ed36d059431accde9bfe1c744473e32a17a40a34b587b96d30c3772fcbf48545
MD5 aaac2d1e87e715ed73630e406c5da8aa
SHA1 0c323663bb5c1880e41f42680fca88a3049aa255
SHA512 3c80907dc5c6957ee50d08f652af964e3e7fdd36d586da88769d1c0a4f6ae66fbb747e1f3203cf8ada703341e50484297b22600d3f89d146f2f6245a0f8644c4
SSDEEP 384:QirrjNX5r0D1FQNkMfymFSV5/WCqlCoiC:QirrTK1FQjvS7WCqwTC
TLSH
T11962D034C309E949035CAE28DB0B23BA5A44DC8DD5ADEE36EFD661F7328E1252255323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-changjei.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.locked
Size 9KB
SHA256 6ec07cc0fb4e2cb923eaef980fe81924e1d1f0be369966e70f0ed6d4f67133c2
MD5 34bb68a2c78129704ae3f4496804adfa
SHA1 d4f84a5899d261c37c7b91cf76b8ece6e092747f
SHA512 a8b6a30d1e1adf86caf7e6921f75219750046fb195f074ef33abf54283faeeb7de9e01aadbd3de724ec5d6d84d9470ce034bccc6439b3287f6a5ace00cf67bf9
SSDEEP 192:psSOctrf52c4rCztv39b8jwqY5Pw0H4DElXJgdCFEnRK7zbD:pBJ2c+Cztv56wq4wjU5gcz/
TLSH
T13512AF737022A32DE07FE1D9BA51089844905E4CD381D9565E53FFAB83A8D5383ADA2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-dayi.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.locked
Size 10KB
SHA256 682e23a622d23b88c16fe3e3b15e280abeaa984d10b915175f0786e131408cb3
MD5 444c39b7e9938b333b3b097ccade971d
SHA1 c98bbc2d1ac7527b7d803a2920f1d3d7e2ec3f91
SHA512 11b341ede47b5cd36d12d556d3d5358c0ddaccccc61b71210b1df08f3f0b9b84d23cd6e7aa38f949b60674a98a729314a9480fa922d661cd15dba7dac75a6690
SSDEEP 192:/+VmMMS1/+W4cxTpMs9eY1EaGjnm37WakTsGSL69HlymeG+gWb0uRxkBvgYI:/+VqpSxTaOeQ8Ba+PGPmeGpWbXXas
TLSH
T16432D15C9C6DB9E94004DBC2C21BB775D770A467E8B3C3BFD12800C188F48A05E6CA65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-phonetic.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.locked
Size 10KB
SHA256 a3dbc41d0480d0805888ef9f7c9d313d412e7f103e66c590e0addac91c3a37ba
MD5 4027aebfda2d9b5180ea0df7e843ff0d
SHA1 b50a8cf28350398950bd5de3d86bb1594f5c73a4
SHA512 707119417781ae49f169ea103ef9934d4702d2ae171f9fc1dcbea3f4343452772ff31c879a5bf52b14d0b06bab85aa3b32afa068de9d258f84e61a9696d49487
SSDEEP 192:WGz5smxrBvld9CHdmm65/Ia6aESLJog4kHssTO/dx6e+qjBlOd0XSRj/W4kpzVRD:ZftNd8dmtZ6KNorsW60BlHXSM4qzn
TLSH
T18032C01B8D4B54D0CAF5DB43F1CEA8C83CE96C68B29151120B8CB45DD7FDE643A89265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oskclearui.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.locked
Size 299B
SHA256 e6fe80e7bb1fa37efcc9cf205a35c4810df8b193ea5e00abba753f61ffe6b086
MD5 ad7efc769f37147fed1c744a0d856487
SHA1 e4311fa0cb27b5d6a3a37aa3a5fa6163cf0857b5
SHA512 14324f5ddafc09e3efec353ebbf68b53ef5d54cb3eadd30f02ed893f3220fa5be0414621578b46e26c90f0ae5cb5441c11e7f22605a3bdbe6dc7e71e1f7cd47a
TLSH
T145E07D300B432080E66674F18065392350423A4C2E90392EE6362676998980A606841D
MD5 SHA1 SHA512 TLSH

Submit Download

oskclearuibase.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.locked
Size 815B
SHA256 59d532d81651fcb7b3592e8e11829e54a2e61d694630048aae7ebbaf2bc1df39
MD5 fc36b812eb854c976e186468d0288955
SHA1 60e0f1d678c29973973e122d5434b5b06f186d7a
SHA512 ccce04cce817f177bf5eff03c075bfd8ed9a248b77446a73dd42a225106201f4e54ba1cd6c3f6bfddb75dd0d28a73040bd51d7fde7f283268b4091c6f71b33e2
TLSH
T1D501D6E3A63430BF90070AF247A26AD7E8C4BAB00970F933C1A1027B35A841C05C5D8D
MD5 SHA1 SHA512 TLSH

Submit Download

oskmenu.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.locked
Size 293B
SHA256 4b69726fa11ccb72162179fe824d99ddf3dfb99b9184234980f1310636507744
MD5 3e93f6bf54f5797830fa7c510f968507
SHA1 da9983791eaf8b3b0c0e1ff1fd7cdde43f8bf7f4
SHA512 ba351938289a84027deeedf6f00ea389dc9859dff582212b1f100318ef97fe5d91e19b9152e88254de7e5b508eefdf504bcee0914b6b06989594dc9419c2cf87
TLSH
T11DE0E7854777F3D4940C13B0CC0C10A1642421DD73047F319AE305647C31D644910C64
MD5 SHA1 SHA512 TLSH

Submit Download

oskmenubase.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.locked
Size 549B
SHA256 18f4461fbd6e1b63bacec868c28c3e933ec972adfe7e56ff6a090228a049b12a
MD5 ace12c181a4288aad30a2ef907a21e66
SHA1 f72831f6f6ed40bcddaa64bf87727ebcdec0f1e4
SHA512 e8e1c6110ce8e12f6b46f983380b55eadb80b94a6cb7e3d856ef01208607148fa7dbb5d0327e483d8a7eaaa937d904827a5b6b24418cef82041480edbd1f20d9
TLSH
T17DF020F592CB99FFE40920ABE33B20F39240011AEA79A29E104E38866D51A00600A70A
MD5 SHA1 SHA512 TLSH

Submit Download

osknav.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.locked
Size 291B
SHA256 b4b3fdfb51136e9f9496604de9869d3bc42ff358ee6439083fbfb34352c62b47
MD5 8d66b94b1bf167eb849d27a35c58605e
SHA1 8ff70bdb07c2e8af306d8c3636230731d5cd0d84
SHA512 d39a21cbe4e65ec971f746486cc2ca14c87f6a100073cef2e01be9c16e8eed9fed09ea80a189bc777c7aca36df6bbeea9829ced5b1fe8b343c7d0fc826c35b71
TLSH
T11ED075763403F3E1CCCC9135D4883D177852360131502372FF54C20ADD348AAD2300C0
MD5 SHA1 SHA512 TLSH

Submit Download

osknavbase.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.locked
Size 1KB
SHA256 e1c2072ba7737eda2d9ce18cdc61f6be59a8c93bf6aabf9f3a7be2a10641d82c
MD5 8b78d8c66e4d626e6adc5a90190181aa
SHA1 8b71546fbd85610f93a10cb6a12e5728178b96cc
SHA512 2e400fc2f4c9b71a3e80919533f41bb96b55151f94bf9b186841db9848d858e4dde5dd71b6dad89138b766d0a660ef07c7bc7bf96b4063c5cac749fb7c1b824e
TLSH
T12A210A37C86F8BC1DE3CB3284C1A167B3B24605E46E0352E4A58503F8937D099D030CC
MD5 SHA1 SHA512 TLSH

Submit Download

osknumpad.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.locked
Size 297B
SHA256 b65869281ba59c59245517c0e4ace045e855d08a9260dd39479d84aa8f14531c
MD5 78343dd95137b45f25e6151ee1bf4b05
SHA1 855171bf31a92290f1046b65fa678b0b753d8876
SHA512 f77fe880016e504fdeace8d0a47124fef15d5487a3b8c7045be81b568d4298ee5af07429c8b4fb555a9aee3ed3457d3282e4c0f4cec2de8b5360428d700c9ea3
TLSH
T182E07D045D0290A568DC3359D80710D053DB1684477DDBFA893B600A9581FB998001B4
MD5 SHA1 SHA512 TLSH

Submit Download

osknumpadbase.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.locked
Size 1KB
SHA256 32bef8fb6fae243fe046e055bef489a6c74c8ec70cb6bcbc45a66359df947325
MD5 1e50f493000316b1d71f6ff55b950ab6
SHA1 56f4e91c7d1d4a5383aa38f9e2cc5204502cfd2d
SHA512 3faf014c6c190c48f06309988c0f8b5c6cea80141298b138076e099035361bded72f2b69a1cab5f230e78c00280b3abfcdf17351c665d60fdb9b6612c4e76c74
TLSH
T18C414C3E53B9E963A197BCF1305900A0C5D5037DBB4856A209305D16BA7B4F4930B0BB
MD5 SHA1 SHA512 TLSH

Submit Download

oskpred.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.locked
Size 293B
SHA256 e4953ce4ec6ed637c2f2da1c9d7008d7e168b8314b245ed4e07fe6faa55a916e
MD5 12fc78583f7060d1761263126498a9da
SHA1 0fb9f62473c9e845862eccea83a4518f267d9ac1
SHA512 9ba96707dede7b8ec3cc308f55f4ffa4f73e2701cb418e2e6d15b71c993964d9f4cfc8b496d2cea23b67301335943576cdb8c46c9b6eaa49777e90d912162396
TLSH
T17CE0EB72464A74D8E488E23592ECDBF246C3208E1790E6AF7A62940407FE9C142602C8
MD5 SHA1 SHA512 TLSH

Submit Download

oskpredbase.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.locked
Size 1002B
SHA256 f3ba59ff4e2f02ad1c01bf5662426c45390088f0299d0eb58051b392d35ef2f2
MD5 a8485525063457b44329aa54137807c1
SHA1 a8a901e90f90fadb15717c791bf3252995582b3f
SHA512 67c80156e8ffca146edc00760a18f656d3dabdc18d1f5f003009f028d7e161e352b786506abad5aab4bc89abd88631151a1e1facde54c57508b27251f56a7325
TLSH
T11511C8801826F6238C3C19A2891F1B3716B165307A2475A7E1A33F8355DD94065B8192
MD5 SHA1 SHA512 TLSH

Submit Download

symbols.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.locked
Size 669B
SHA256 290daafa9b1cd8b22c0ea037bd66c4931a6214a13f3959e6ef1e5cd054734fd0
MD5 ce707697486d0e079b0e0b2013614592
SHA1 47dc8212cbe382e94f490017f18f739ef68c916b
SHA512 06656f70137c86ad4094d8d218319a1bc0acce902b9543ee68219c88c523f63da6ac03772e35d703308df3463606210d7e12dee7d211308bb3d2bc9f06113b92
TLSH
T15D01885AE45961FD9D7115B1D1CC1AB0F5805504078CFCF2D925F2B36701D5542A4943
MD5 SHA1 SHA512 TLSH

Submit Download

ea-sym.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.locked
Size 772B
SHA256 77de2536fcc62d5f1f8efea12c455488645aafe225fcac4bf5b5f2ce789a7976
MD5 1a8d85333201afea5105da6301ba4fd2
SHA1 db63b0b8e0215c2738ef306fd0f34f414796af5c
SHA512 889509a47450c90807f349642a4b6e0ded0e7d899f4ecb2a1e9d4dcb655624cf08bccb20585c34bc22c5a4cfd02b44c602d45d6f824344932e993e2e71cd13a7
TLSH
T1DD017548901FF1E1C0C4C6B0183121D5BD9574155911639102F85CF2EDA08B8EB91E7A
MD5 SHA1 SHA512 TLSH

Submit Download

ja-jp-sym.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.locked
Size 883B
SHA256 3a8fb1101f72a5f3a7402df948a1ab03259d7ef8d0c9202c213c82f222cd0009
MD5 0c804a1ecb5df4c153a4f865d2a62da9
SHA1 95311aca0f63d513feaea1df9d900addfd2b15d4
SHA512 88fd15f2d17bbdb07663ace194482c56e7d4a10bab8c1ab2ad6554c9f12c742e828ffee0fc63d02275c84f01a5572b6440393d106c4024dd8e10aa1b2ff6c6ef
TLSH
T1BC119643CD70AB409C62C2FB486460EFD50EB44A5224017F2CA27390AA27020B07829C
MD5 SHA1 SHA512 TLSH

Submit Download

symbase.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.locked
Size 3KB
SHA256 0c623c89aa9fdfb7cac3f0427734d7c6688fb4e2137c6787eea9d9658a94109d
MD5 12dc36590ac64cbc42dddff281baa75a
SHA1 7ee18f5e38dd49d1c9d314268e7c87aaee1765fe
SHA512 c5feea248a87b73c40c888786aef1be2713894f9a90509a88a4db8d9e41340d2e10d3527f59009ad9bca0daba3f03a192a44edf0b8557ce1545050cf8bd24182
TLSH
T1B9816D609289A968B02F8936F7F876B79A0C4F1C8E7071307D91C1DA39804B5F734982
MD5 SHA1 SHA512 TLSH

Submit Download

ipsar.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.locked
Size 2KB
SHA256 259475463e034fa3e693c7dee0e43317fa2b7b6bb68d19552c9db361503cf674
MD5 096cb38c04721697db048c4f4faac817
SHA1 5c5d13d2cd9ae6bb33ae181989b0b0b2e1d85879
SHA512 0be2eaedf50bcedda1b747f6b86382561e64241b534459cb8683531dd03e90456d21bb4cd5574af14351cb38825556a371e7aec59411c28f7a5122930a95e535
TLSH
T18A512A677C7745B07D8E26B0439BF8E9DAD3001C6E1FF098CB1B8174A89372CA40C655
MD5 SHA1 SHA512 TLSH

Submit Download

ipscat.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.locked
Size 2KB
SHA256 05a437984460518be7006cf408773a8389c525accd10298e3b70caa1b8c4642b
MD5 d19d98fb63c8d1d56e89ad84d09a3a37
SHA1 878d5b812ff550be3cbddc7c3ca7fabf1472dacc
SHA512 cc92abd8833d2ef439373d4563da4dbab4857877bfdebcbf8a19166c9536d48b60fdf2f949e153d7231cc0100d7000b2e06c02b494bf752599c6805526009f5d
TLSH
T1EF515BAA3173B2E62C401767D2D878A524AA22482D14C27F91E3E711C16DC7B766E803
MD5 SHA1 SHA512 TLSH

Submit Download

ipschs.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.locked
Size 2KB
SHA256 e8f90c184781cf3647f20bc9e86ae81007b6fd0b018ad5bcbc84e2b5fe1682cd
MD5 8811037682d8a6952d9115e751997f18
SHA1 eefd25824b87915cfd493c590763d5cdd89a7b4e
SHA512 baf23c538151b4dd3082f2ed2ee9e31be751eb0dff4aa234ee05e643443f34f3d438e47b43b8e709b1e189b1e7ec46ab56a1c817080b1966beb4ea9b3934e41a
TLSH
T1C5514A015122D00744FBF454D06372A303DB0E6222680AA3A8E3A7AAB14BDED70B95C9
MD5 SHA1 SHA512 TLSH

Submit Download

ipscht.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.locked
Size 2KB
SHA256 dc10aa2e1dfe54fdf2be80fac8977bb8271ebf995852eb1675d5961a7c4250e4
MD5 e7511f4eaf1c217a73fe710b0bbd26a1
SHA1 1eb348244a048456de3d127809846cea06897765
SHA512 be33dc8fa7bfc1f133319c67b5bebef3973e94d9783a88d00d79ad74d0419b3fd0833ebb8771438acddc377923c87b9ffc95ebe33267549de737716716eafa4b
TLSH
T135515AF80F19096BEC9DAEBC1217DB2198D100A3FCA9880927D09C6DFD0FA6C8984C09
MD5 SHA1 SHA512 TLSH

Submit Download

ipscsy.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.locked
Size 2KB
SHA256 4083acbb7c30362e32025abb03095edfcc04c1bb95ee4bd89bbb12963ba91633
MD5 bd076faa9fd1a430de5f8cc7caa44d06
SHA1 75893be82bfe96213dc16b3d1c73d02f2bfbdd7e
SHA512 16f9b5af95a448bc278ab2b4224c62c80474738e074e55e614105c9019db88981604a743c0fe84caca4058fcc727beda66039a34e82067db7668e181092e1f4d
TLSH
T11B512C61248068EEE784C34A33AD3611386B9D859B7C9F4C6D9C1671B359577FE80943
MD5 SHA1 SHA512 TLSH

Submit Download

ipsdan.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.locked
Size 2KB
SHA256 9fcc6e2d0016a78c3a57fdacf05e059a8b0e9b95e916ce8f84a633d6311a1f1d
MD5 8a72fcce1590ed058ce828d12dd77c48
SHA1 fb1ddd1312fd2da22b5d7ec9c99ccb0084ebba7d
SHA512 e12893734a763d2c753ce499c05423076f1f4932ce2b85fbc2903b708532a928a9967754a8bd7f447963d27db4fd7d57648ecd353bc085b3b4fe657c25627963
TLSH
T1D2516A55BC5832F3758F3D6ECB99602E8B45C049A00121436C04830E9B3F16CCE76E45
MD5 SHA1 SHA512 TLSH

Submit Download

ipsdeu.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.locked
Size 2KB
SHA256 49475c29dac61910e2f2898b75efc7138cb7a3f1346076938838f5408efdf928
MD5 3ac67f15ac0a8bf68ecec5dffc28c1dd
SHA1 154a09adfb05e840777e282230aea28b9cae6a82
SHA512 374a6a7fa00f44435a2005788ac8745c23388fe11ed8756d7ed810f7e3a4b512b7b57b7a83fcc2901c8b259fa9d2c6f376ea5fc4d8aeaa264e299647033a6b3e
TLSH
T164516C18A1D3D8AA9D70B2E9CF947C5B2A5232235384D014CD499BCCB0E4D668571DE3
MD5 SHA1 SHA512 TLSH

Submit Download

ipsel.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.locked
Size 2KB
SHA256 96612d6bccce6d4b8b3ef8b0fca5440636def0480eb01f58c3b67dd8132b8aec
MD5 410e3e35a4f6817e0566e54ab1fcc4cf
SHA1 f7879aaf99949a95d8c18cdba3aa99d9ba204aad
SHA512 836d4ca935145ea50febc7f9601e231470d652117666d8a1d3a034be0c0cdc5b4e87e881cb84217ba52d3789f7a4b193d6055a4481e2ff23e53cf41c59b55153
TLSH
T1D0514B7B92BB2925DA38E4AE0C43FDE2045B739407A2141D127EB562F26C0292A44E4D
MD5 SHA1 SHA512 TLSH

Submit Download

ipsen.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.locked
Size 2KB
SHA256 3b6a6821e151c6141ce1c2258ba9642aa808afc442f55609ce198b5535f49dfd
MD5 6e58decb4b6e8e2d49370e649f349f4d
SHA1 e3f5cd40c7650d77ed9266948984870c45f404c1
SHA512 b8a08c861e1e1633ea5533bf074b277b804b7d490c9280b3c36230e867ffd181d7cf8fa5b29316acce4d7e63864cdc017d1f525c0d924ba91e74e1564f8a6f92
TLSH
T174516E180029D14CC51B459E2EE95757E33B66C187F0EA978A2D8E9D1480D9CA1350B4
MD5 SHA1 SHA512 TLSH

Submit Download

ipsesp.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.locked
Size 3KB
SHA256 c5486a052ae5be54b72e510b4c03872fd3ad55b230341e76a43181f17be343f1
MD5 7af53ae4791ada5626571621f1b4eb8b
SHA1 99cf01be2d5503154e148995e1292cbb01397b99
SHA512 8f1f5177b30731d1e5217aac26891029025a4ecea0c7adeb321c6a0072294370437c11338725b46a02fcdeafc10dcd4424cc02a42d3518b9ffcf7ba19517748f
TLSH
T1FB514BB28ACA0082133472F59957C9E875DC2302CAEDCEE1ADB9EED04018705B6865E4
MD5 SHA1 SHA512 TLSH

Submit Download

ipsfin.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.locked
Size 2KB
SHA256 41622418d4eabc3c8744062c8ca6de3cbd626ccfce2d805847e9db2f4f39aa1e
MD5 f967fc9e123eaa50ce16550cf8dde305
SHA1 1ddd967f4240880790bef63f7e6ed74bb0b3ae4c
SHA512 1641e953dc7c773c8e039e49ae4d059782a9d85398821629821382bbe3bb6f4a25cb8de8d0f4372bd9a844ff35009b4c0e7db84204513ba1f34c6012e3e8cd33
TLSH
T110514B5CD1F9EB2ECFA08432D8A34F027ADEC0782D24D471EE0249A4F351D1A8242D6B
MD5 SHA1 SHA512 TLSH

Submit Download

ipsfra.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.locked
Size 2KB
SHA256 d1b5ac85f5e43e9f0329710563e89ec449e0d570b1e3fb4c35ee95561444a011
MD5 dd0e791898a18256ab90417b92c22327
SHA1 2b0f72a8d1aac3cf361d85e8a0b8cccf71602450
SHA512 b37eb7d258f85a4176ec286381179935a49126a033d7108e2a4cc00f9858ef47a949e2abf2fc975ee60786d2a6da09f3baf43d28a27e18a1a233f99c134f3c81
TLSH
T13B5159F58A92B6131D831864F8E03DA7D19F0904816333EB4923DB909FA08C8C1A8F41
MD5 SHA1 SHA512 TLSH

Submit Download

ipshe.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.locked
Size 2KB
SHA256 3af41226d5636db716485f91dd33f2e8d0c53e4e5c7a0c95035ab044d3d16e21
MD5 b601388280a6f99511864fee992c3cb7
SHA1 8e65361294712fdc9da59d321b4983e9ae55a509
SHA512 4e1aeb5b1e3401fe95d20f402dda00e3a469193c8b84c9d3639fd7dbea91a9afdeeedef1ca7a42ea55177a4b3e0723bfd5a82305cbef00ecdc7cb3c7f2920d90
TLSH
T12A513C7AA7FF98F7C24E483C48948CAB3B0CD94D631226567D14D08748ED431B4BB346
MD5 SHA1 SHA512 TLSH

Submit Download

ipshi.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.locked
Size 2KB
SHA256 da45a9a7bd3ef583e4efcc0e414b8ce4bc6b3c1b572b7d085641733689b765c3
MD5 e0145aeebe043ea9c41c62005a41bcab
SHA1 b77f27ec9ecf025ccf113f747b9be702b91bced1
SHA512 99d630db88a1883b1c6239fd83aded41f8f536ad60bb172061992a79a46b6a182b8804455033bc8f9cd42e69af691f68934acad275720c76183aeefc9b5bcf15
TLSH
T102513B865F1B64F5F06C245E040F74920E923B14EB8855B0ECF4973BF34AB95B009AAF
MD5 SHA1 SHA512 TLSH

Submit Download

ipshrv.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.locked
Size 2KB
SHA256 600b4a28b3c949dcc2559db05c47f9ea6e26ee1f1ff81d22c8e0b12adc1aa047
MD5 6bfe9e976a6fb86f798d116bd8d7350d
SHA1 c560169f9df05d808950e30440bf2d78fa6bc3c7
SHA512 4bded9c40acda507c5b48ed375c8827e25c3d54ce10fdd5895be6e8c36b993f5d0df1d29425343aadab2624bf2a7f82595f41be8f765e963ba24a01c8623f2e6
TLSH
T1B2512B67E7665EC87A20AA1530088665510E37525FDA9F1FFBB1B0FF4C9526049390C0
MD5 SHA1 SHA512 TLSH

Submit Download

ipsid.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.locked
Size 2KB
SHA256 dbc2beaf33bb403795c96495703ce6517d79c180abb2f5474e4a6011c725b915
MD5 7d62e74c55f1ed06b9cfbb33c1d7e152
SHA1 8967b6229c948d7d0bad4341e51f8ba64c24cfe4
SHA512 d716de4f7cf994f204d6872899530032e9cfd9a09e8d784557e8cd4b6df47b8ba57e096b6555b559a74dc83fb1467b736af135b87e6c634707ccf1664a79cd19
TLSH
T13D513C12D1814CCC68678F752EF291B57472689F042DB27D5A29F4605C03DAB745AEC8
MD5 SHA1 SHA512 TLSH

Submit Download

ipsita.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.locked
Size 2KB
SHA256 27960d34b40a0f9cbf7218b832033580b256c39b1f360636682eabf74e2ca6eb
MD5 16039a86ca0400b4504b37b624cbf56b
SHA1 d7d3e6b6190c0183006b55a9cdcaa65b69fb5240
SHA512 520b2c8766941f1735f06cd284fdede7d48334a1b96f04c7c07cdaf313298e1c945828fe4d8d2139eac9f51849964ba8f755ade9200081965be5b0fabed0fccc
TLSH
T106514C68F9728601F60A86C539C2BDFA1746AE3683DA3AC28451FEC1CD002DA5C5F54E
MD5 SHA1 SHA512 TLSH

Submit Download

ipsjpn.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.locked
Size 2KB
SHA256 85f9f97ac61e1206cd4352f2e778e24b77a543efa436fdf9aca115dfcca8856c
MD5 9030fb21bdb9243079b3f76cab351b82
SHA1 9bf457c57251c6cf64a4f57e750154f720fc1477
SHA512 adf4d7a6f3c3617e99e5d471c937f8c39c6437e78ea750749dbba7bebb636bfb868bbdf8ae516011b295dff5bb7c6fb7cf35b05d00f4c7c1fe06872cc49ae46d
TLSH
T169512BBBA1DCF25C6714DAC185C7B81580CE4AE023B2FA39825E30DD9696A9E751420D
MD5 SHA1 SHA512 TLSH

Submit Download

ipskor.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.locked
Size 2KB
SHA256 078338e6195d8c6664b979aae24381df3b2c52a76083ffca5e318726ca4fb0c0
MD5 982d0abbc91b6c630bff0b3ad20f99d0
SHA1 963f7426f877c101d806de0837210415f46da47e
SHA512 0cda9d70fb738df366258e13da231dfd05048884afa93c76f003098afd086b588e08ad8dfbeab05696e40e011b25c37abfc90f305d34242dfd2ee0722ad6236c
TLSH
T104515C9C6D807D3CCC3A233D0859723CD494BBBD31284153D0685DDDD0357A5E8047AD
MD5 SHA1 SHA512 TLSH

Submit Download

ipsnld.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.locked
Size 2KB
SHA256 3ec72b54973b67cc9a4467044079296d17dc7cf29c379cb8eaa134d99a9df23c
MD5 d8ffed775dbccfc91f02fa21ffd2dabc
SHA1 3b485701fdeabf2fd41dc201f2bc12fe6c5ccf8c
SHA512 d7d9db23d2a15fec59c1a6951354816bda4a01da11f495c7e86942bcd1ca962976d214c5dc81749375ca48404ce374a694646a5c1e13650ff029f03849bc0572
TLSH
T197512C0E6A956846DB6B2EF1F8F6D407C0329A74BE7DAA538352C8C0636641249BC928
MD5 SHA1 SHA512 TLSH

Submit Download

ipsnor.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.locked
Size 2KB
SHA256 628a97775624bef2ecbc463da57a6dd00ed43d4d5b3d60fb218975215e8df059
MD5 d53c0d77eea053f0de26207e1a9b9608
SHA1 fc5039ff909536cfed420021f06c166c4aa6c351
SHA512 0e1756e3264f465313d4d3464e2d5aa8406bd42608baeb38e52c7bcceb73b58bd99be4133b3d658f62942d13304dea145594f7720016bc6eefaa102207a63446
TLSH
T1D6514D236C5477F407BB570937CEEABE2589040E98EEA41A1D132F5516631CE43DDE70
MD5 SHA1 SHA512 TLSH

Submit Download

ipsplk.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.locked
Size 2KB
SHA256 cb8e3f48746588d40fd5689af5a275ef63b5a387d0d9a72665827bbf336a99b0
MD5 01f43bb15e0039ba89e6c73d985f36e2
SHA1 13f5c5b47e100a5a49539a33335c06c41068a9d0
SHA512 4466f872c76baa216d5527d92ffadb616a1989dbb539eaea25a4e005035f8b2802598e5d09567fe25607842fc6a92c1fd58378940371085dbd894a6ce73757e0
TLSH
T1E7515ED1E4C151BD2A9192CC81DD30A8C7E29D41C611D9FB798C81DEB9D54BE06F3E74
MD5 SHA1 SHA512 TLSH

Submit Download

ipsptb.xml.locked

Path C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.locked
Size 2KB
SHA256 0b4b8eb8f959d589ff7d10bbdb97f1d660c05642478cb7bda3c7ff7db3b1305c
MD5 0010ba5a603585c9eaa8f626f1f21f16
SHA1 4d2098efd2d1d0c82705aa43f593e0d4cde5b450
SHA512 a38dfcfd17b3300280510ddf26786882af38cbcda62994b65f04809ca180e1cb7930d3e938654e54ad7e9709aae023d1aa3660d0857cda8835cef50642371038
TLSH
T16E413B538731B87DC138A35BC9F581E1F2BF54F23C78222887C165DC6506DCA05A4F82
MD5 SHA1 SHA512 TLSH

Submit Download

victim.id

Path C:\ProgramData\Microsoft\NetServices\victim.id
Size 36B
SHA256 53b0933b607c5eb9cb61cf192417ea47e3cc74ae4ca6688ea69310bc5c6c691b
MD5 775cb895c1db721d5d0b2fd545a85209
SHA1 1d39ad8aa83c8ace03a3c305c17ebd6e948c574b
SHA512 735920d76a28965dfbc3b8f538273ee32f6322baf7e80e1ecf435d014091172d45fbc1fc6f768753ed879491f1e1ce3bc72686a8940b9a09e767dbc4ceae1e8f
MD5 SHA1 SHA512

Submit Download

wrapped_dek.b64

Path C:\ProgramData\Microsoft\NetServices\wrapped_dek.b64
Size 344B
SHA256 f00ccc80a65ee0449d0e360e7955c689a498be5a2d63b7b435e6ffafff5d0f07
MD5 890a7d0b370380aba161b17d379a34e5
SHA1 c17783bf1786b418c4ce0146c88337571b7dba7a
SHA512 73c9b1eddabdb6d893b2fceb3e8027268dfca461f3e63715db757daa7bd26a66c6b86f9ce3bb2983990e0bd68e7f8627c224a52b08e5a63714b9e49d2fea9359
TLSH
T12DE02890581CD4472270107D21C704254A4ADDF30166434412DBCE0F8E067CD0457EC3
MD5 SHA1 SHA512 TLSH

Submit Download

RECOVER_FILES.txt

Path C:\RECOVER_FILES.txt
Size 278B
SHA256 c313f64ca65535cc00d0ace3ef306c928311d098a303715e5878419be7be4b98
MD5 83e93724e72cbc8318124dd25c6bf2c2
SHA1 1249fcaa8c1f89f10b2eaf88b0e71e93676de299
SHA512 cb31a6ec0dc32e553c5c4946ff9d40af0588779e8ad1444c13aadce4ef75348c2ac1e52e9c7f5e0344a95c000a42cde57c6bfb7078fbd6925cef6080d92adefd
TLSH
T126D02B2996CA371B5B255AF552CA25A5DD16D04EB55000146401609C2BB7B12A02DE68
MD5 SHA1 SHA512 TLSH

Submit Download

memory/748-10505-0x00007FF7F38C0000-0x00007FF7F4537000-memory.dmp

Download

memory/2132-8145-0x00007FF7F38C0000-0x00007FF7F4537000-memory.dmp

Download

memory/3208-8143-0x00007FF6F03A0000-0x00007FF6F07EB000-memory.dmp

Download

memory/3208-4-0x00007FF6F03A0000-0x00007FF6F07EB000-memory.dmp

Download

memory/3208-8141-0x00007FF6F03A0000-0x00007FF6F07EB000-memory.dmp

Download

memory/3208-200-0x00007FF6F03A0000-0x00007FF6F07EB000-memory.dmp

Download

memory/4332-8142-0x00007FF6F03A0000-0x00007FF6F07EB000-memory.dmp

Download

memory/4332-201-0x00007FF6F03A0000-0x00007FF6F07EB000-memory.dmp

Download

memory/4332-8144-0x00007FF6F03A0000-0x00007FF6F07EB000-memory.dmp

Download

memory/4504-1058-0x00007FF7F38C0000-0x00007FF7F4537000-memory.dmp

Download

memory/5412-8146-0x00007FF7F38C0000-0x00007FF7F4537000-memory.dmp

Download

memory/5420-8151-0x00007FF6F03A0000-0x00007FF6F07EB000-memory.dmp

Download

memory/5420-10504-0x00007FF6F03A0000-0x00007FF6F07EB000-memory.dmp

Download

memory/5736-203-0x00007FF7F38C0000-0x00007FF7F4537000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads