f3c7a8dc...0eba | Files
Logo
Try VMRay Analyzer
VTI SCORE: 91/100
Target: win10_64 | exe
Classification: Riskware, Ransomware

f3c7a8dc83493b7257a705843ba350e171572666483de057f85f92da510f0eba (SHA256)

f3c7a8dc83493b7257a705843ba350e171572666483de057f85f92da510f0eba.exe

Windows Exe (x86-64)

Created at 2018-07-10 04:53:00

...

Notifications (2/2)

Some extracted files may be missing in the report since the total file extraction size limit was reached during the analysis. You can increase the limit in the configuration settings.

Some extracted files may be missing in the report since the maximum number of extracted files was reached during the analysis. You can increase the limit in the configuration settings.

Remarks

Some extracted files may be missing in the report since the total file extraction size limit was reached during the analysis. You can increase the limit in the configuration settings.

Some extracted files may be missing in the report since the maximum number of extracted files was reached during the analysis. You can increase the limit in the configuration settings.

Files Information

Number of sample files submitted for analysis 1
Number of files created and extracted during analysis 61
Number of files modified and extracted during analysis 119
c:\users\ciihmnxmn6ps\desktop\f3c7a8dc83493b7257a705843ba350e171572666483de057f85f92da510f0eba.exe
»
File Properties
Names c:\users\ciihmnxmn6ps\desktop\f3c7a8dc83493b7257a705843ba350e171572666483de057f85f92da510f0eba.exe (Sample File)
Size 212.00 KB
Hash Values MD5: 54ef8e14e8e1dc5a047c546333e60658
SHA1: d747651b1a01e38da6f46289f9a9e0cc0c4f3135
SHA256: f3c7a8dc83493b7257a705843ba350e171572666483de057f85f92da510f0eba
Actions
...
PE Information
»
Information Value
Image Base 0x140000000
Entry Point 0x140001570
Size Of Code 0x20000
Size Of Initialized Data 0x16c00
Size Of Uninitialized Data 0x0
Format x64
Type Executable
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Machine Type IMAGE_FILE_MACHINE_AMD64
Compile Timestamp 2018-07-06 16:32:09
Compiler/Packer Unknown
Sections (6)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x140001000 0x1ff73 0x20000 0x400 CNT_CODE, MEM_EXECUTE, MEM_READ 6.42
.rdata 0x140021000 0x100cc 0x10200 0x20400 CNT_INITIALIZED_DATA, MEM_READ 4.47
.data 0x140032000 0x4058 0x2200 0x30600 CNT_INITIALIZED_DATA, MEM_READ, MEM_WRITE 4.34
.pdata 0x140037000 0x1cf8 0x1e00 0x32800 CNT_INITIALIZED_DATA, MEM_READ 5.11
.rsrc 0x140039000 0x1e0 0x200 0x34600 CNT_INITIALIZED_DATA, MEM_READ 4.72
.reloc 0x14003a000 0x7f0 0x800 0x34800 CNT_INITIALIZED_DATA, MEM_DISCARDABLE, MEM_READ 5.42
Imports (151)
»
KERNEL32.dll (58)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset
GetLogicalDrives 0x0 0x140021050 0x301e8 0x2f5e8
GetShortPathNameW 0x0 0x140021058 0x301f0 0x2f5f0
ReadFile 0x0 0x140021060 0x301f8 0x2f5f8
SetFileAttributesW 0x0 0x140021068 0x30200 0x2f600
SetFilePointer 0x0 0x140021070 0x30208 0x2f608
WriteFile 0x0 0x140021078 0x30210 0x2f610
CloseHandle 0x0 0x140021080 0x30218 0x2f618
GetLastError 0x0 0x140021088 0x30220 0x2f620
TerminateProcess 0x0 0x140021090 0x30228 0x2f628
OpenProcess 0x0 0x140021098 0x30230 0x2f630
GetModuleFileNameW 0x0 0x1400210a0 0x30238 0x2f638
GlobalAlloc 0x0 0x1400210a8 0x30240 0x2f640
GlobalFree 0x0 0x1400210b0 0x30248 0x2f648
WinExec 0x0 0x1400210b8 0x30250 0x2f650
lstrcpyW 0x0 0x1400210c0 0x30258 0x2f658
lstrcatW 0x0 0x1400210c8 0x30260 0x2f660
MoveFileW 0x0 0x1400210d0 0x30268 0x2f668
CreateToolhelp32Snapshot 0x0 0x1400210d8 0x30270 0x2f670
Process32FirstW 0x0 0x1400210e0 0x30278 0x2f678
Process32NextW 0x0 0x1400210e8 0x30280 0x2f680
RtlCaptureContext 0x0 0x1400210f0 0x30288 0x2f688
RtlLookupFunctionEntry 0x0 0x1400210f8 0x30290 0x2f690
RtlVirtualUnwind 0x0 0x140021100 0x30298 0x2f698
IsDebuggerPresent 0x0 0x140021108 0x302a0 0x2f6a0
UnhandledExceptionFilter 0x0 0x140021110 0x302a8 0x2f6a8
SetUnhandledExceptionFilter 0x0 0x140021118 0x302b0 0x2f6b0
GetCurrentProcess 0x0 0x140021120 0x302b8 0x2f6b8
IsProcessorFeaturePresent 0x0 0x140021128 0x302c0 0x2f6c0
FindNextFileW 0x0 0x140021130 0x302c8 0x2f6c8
FreeLibrary 0x0 0x140021138 0x302d0 0x2f6d0
GetProcAddress 0x0 0x140021140 0x302d8 0x2f6d8
GetStartupInfoW 0x0 0x140021148 0x302e0 0x2f6e0
GetModuleHandleW 0x0 0x140021150 0x302e8 0x2f6e8
EnterCriticalSection 0x0 0x140021158 0x302f0 0x2f6f0
LeaveCriticalSection 0x0 0x140021160 0x302f8 0x2f6f8
DeleteCriticalSection 0x0 0x140021168 0x30300 0x2f700
SetEvent 0x0 0x140021170 0x30308 0x2f708
ResetEvent 0x0 0x140021178 0x30310 0x2f710
WaitForSingleObjectEx 0x0 0x140021180 0x30318 0x2f718
CreateEventW 0x0 0x140021188 0x30320 0x2f720
GetEnvironmentVariableW 0x0 0x140021190 0x30328 0x2f728
GetCommandLineW 0x0 0x140021198 0x30330 0x2f730
FindFirstFileW 0x0 0x1400211a0 0x30338 0x2f738
QueryPerformanceFrequency 0x0 0x1400211a8 0x30340 0x2f740
SetLastError 0x0 0x1400211b0 0x30348 0x2f748
DecodePointer 0x0 0x1400211b8 0x30350 0x2f750
EncodePointer 0x0 0x1400211c0 0x30358 0x2f758
InitializeCriticalSectionEx 0x0 0x1400211c8 0x30360 0x2f760
LocaleNameToLCID 0x0 0x1400211d0 0x30368 0x2f768
LCIDToLocaleName 0x0 0x1400211d8 0x30370 0x2f770
GetCurrentThreadId 0x0 0x1400211e0 0x30378 0x2f778
GetCurrentProcessId 0x0 0x1400211e8 0x30380 0x2f780
QueryPerformanceCounter 0x0 0x1400211f0 0x30388 0x2f788
Sleep 0x0 0x1400211f8 0x30390 0x2f790
GetFileSize 0x0 0x140021200 0x30398 0x2f798
FindClose 0x0 0x140021208 0x303a0 0x2f7a0
GetSystemTimeAsFileTime 0x0 0x140021210 0x303a8 0x2f7a8
CreateFileW 0x0 0x140021218 0x303b0 0x2f7b0
ADVAPI32.dll (5)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset
CryptGenRandom 0x0 0x140021000 0x30198 0x2f598
CryptAcquireContextA 0x0 0x140021008 0x301a0 0x2f5a0
CryptReleaseContext 0x0 0x140021010 0x301a8 0x2f5a8
CryptEncrypt 0x0 0x140021018 0x301b0 0x2f5b0
CryptAcquireContextW 0x0 0x140021020 0x301b8 0x2f5b8
SHELL32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset
CommandLineToArgvW 0x0 0x140021248 0x303e0 0x2f7e0
ShellExecuteW 0x0 0x140021250 0x303e8 0x2f7e8
msvcrt.dll (80)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset
fwrite 0x0 0x140021260 0x303f8 0x2f7f8
setvbuf 0x0 0x140021268 0x30400 0x2f800
ungetc 0x0 0x140021270 0x30408 0x2f808
printf 0x0 0x140021278 0x30410 0x2f810
??0exception@@QEAA@XZ 0x0 0x140021280 0x30418 0x2f818
??0exception@@QEAA@AEBQEBD@Z 0x0 0x140021288 0x30420 0x2f820
??0exception@@QEAA@AEBQEBDH@Z 0x0 0x140021290 0x30428 0x2f828
??1exception@@UEAA@XZ 0x0 0x140021298 0x30430 0x2f830
?what@exception@@UEBAPEBDXZ 0x0 0x1400212a0 0x30438 0x2f838
_CxxThrowException 0x0 0x1400212a8 0x30440 0x2f840
__CxxFrameHandler3 0x0 0x1400212b0 0x30448 0x2f848
free 0x0 0x1400212b8 0x30450 0x2f850
__C_specific_handler 0x0 0x1400212c0 0x30458 0x2f858
??1type_info@@UEAA@XZ 0x0 0x1400212c8 0x30460 0x2f860
_exit 0x0 0x1400212d0 0x30468 0x2f868
fputc 0x0 0x1400212d8 0x30470 0x2f870
?_set_new_handler@@YAP6AH_K@ZP6AH0@Z@Z 0x0 0x1400212e0 0x30478 0x2f878
_unlock 0x0 0x1400212e8 0x30480 0x2f880
__dllonexit 0x0 0x1400212f0 0x30488 0x2f888
_lock 0x0 0x1400212f8 0x30490 0x2f890
_onexit 0x0 0x140021300 0x30498 0x2f898
__getmainargs 0x0 0x140021308 0x304a0 0x2f8a0
_XcptFilter 0x0 0x140021310 0x304a8 0x2f8a8
_ismbblead 0x0 0x140021318 0x304b0 0x2f8b0
_cexit 0x0 0x140021320 0x304b8 0x2f8b8
exit 0x0 0x140021328 0x304c0 0x2f8c0
_acmdln 0x0 0x140021330 0x304c8 0x2f8c8
_initterm 0x0 0x140021338 0x304d0 0x2f8d0
_amsg_exit 0x0 0x140021340 0x304d8 0x2f8d8
__setusermatherr 0x0 0x140021348 0x304e0 0x2f8e0
_commode 0x0 0x140021350 0x304e8 0x2f8e8
_fmode 0x0 0x140021358 0x304f0 0x2f8f0
__set_app_type 0x0 0x140021360 0x304f8 0x2f8f8
fgetpos 0x0 0x140021368 0x30500 0x2f900
fgetc 0x0 0x140021370 0x30508 0x2f908
fflush 0x0 0x140021378 0x30510 0x2f910
fclose 0x0 0x140021380 0x30518 0x2f918
strlen 0x0 0x140021388 0x30520 0x2f920
wcslen 0x0 0x140021390 0x30528 0x2f928
wcscmp 0x0 0x140021398 0x30530 0x2f930
wcscat 0x0 0x1400213a0 0x30538 0x2f938
_time64 0x0 0x1400213a8 0x30540 0x2f940
wcsstr 0x0 0x1400213b0 0x30548 0x2f948
memset 0x0 0x1400213b8 0x30550 0x2f950
memmove 0x0 0x1400213c0 0x30558 0x2f958
memcmp 0x0 0x1400213c8 0x30560 0x2f960
memchr 0x0 0x1400213d0 0x30568 0x2f968
_errno 0x0 0x1400213d8 0x30570 0x2f970
??_V@YAXPEAX@Z 0x0 0x1400213e0 0x30578 0x2f978
??_U@YAPEAX_K@Z 0x0 0x1400213e8 0x30580 0x2f980
??3@YAXPEAX@Z 0x0 0x1400213f0 0x30588 0x2f988
??2@YAPEAX_K@Z 0x0 0x1400213f8 0x30590 0x2f990
??0exception@@QEAA@AEBV0@@Z 0x0 0x140021400 0x30598 0x2f998
memcpy 0x0 0x140021408 0x305a0 0x2f9a0
fsetpos 0x0 0x140021410 0x305a8 0x2f9a8
_snwprintf 0x0 0x140021418 0x305b0 0x2f9b0
?terminate@@YAXXZ 0x0 0x140021420 0x305b8 0x2f9b8
malloc 0x0 0x140021428 0x305c0 0x2f9c0
abort 0x0 0x140021430 0x305c8 0x2f9c8
_fseeki64 0x0 0x140021438 0x305d0 0x2f9d0
wcscpy_s 0x0 0x140021440 0x305d8 0x2f9d8
__uncaught_exception 0x0 0x140021448 0x305e0 0x2f9e0
calloc 0x0 0x140021450 0x305e8 0x2f9e8
__pctype_func 0x0 0x140021458 0x305f0 0x2f9f0
isupper 0x0 0x140021460 0x305f8 0x2f9f8
_wcsdup 0x0 0x140021468 0x30600 0x2fa00
___lc_codepage_func 0x0 0x140021470 0x30608 0x2fa08
__crtLCMapStringA 0x0 0x140021478 0x30610 0x2fa10
___lc_handle_func 0x0 0x140021480 0x30618 0x2fa18
islower 0x0 0x140021488 0x30620 0x2fa20
setlocale 0x0 0x140021490 0x30628 0x2fa28
_wfsopen 0x0 0x140021498 0x30630 0x2fa30
fseek 0x0 0x1400214a0 0x30638 0x2fa38
??8type_info@@QEBAHAEBV0@@Z 0x0 0x1400214a8 0x30640 0x2fa40
??9type_info@@QEBAHAEBV0@@Z 0x0 0x1400214b0 0x30648 0x2fa48
?name@type_info@@QEBAPEBDXZ 0x0 0x1400214b8 0x30650 0x2fa50
_aligned_free 0x0 0x1400214c0 0x30658 0x2fa58
_aligned_malloc 0x0 0x1400214c8 0x30660 0x2fa60
strcmp 0x0 0x1400214d0 0x30668 0x2fa68
_iob 0x0 0x1400214d8 0x30670 0x2fa70
MPR.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset
WNetEnumResourceW 0x0 0x140021228 0x303c0 0x2f7c0
WNetCloseEnum 0x0 0x140021230 0x303c8 0x2f7c8
WNetOpenEnumW 0x0 0x140021238 0x303d0 0x2f7d0
CRYPT32.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset
CryptStringToBinaryA 0x0 0x140021030 0x301c8 0x2f5c8
CryptDecodeObjectEx 0x0 0x140021038 0x301d0 0x2f5d0
CryptImportPublicKeyInfo 0x0 0x140021040 0x301d8 0x2f5d8
c:\$recycle.bin\s-1-5-18\desktop.ini
»
File Properties
Names c:\$recycle.bin\s-1-5-18\desktop.ini (Modified File)
Size 0.16 KB
Hash Values MD5: 59fc3025bc8efa848846a6325f242dad
SHA1: 052ca3c1a0d60e0dfb98a6e95a5137f557cbbdfa
SHA256: 6eda1e3b1f52ff48d1d6f2b39f231063fb4423084a0472df8ca338024fdb07c4
Actions
...
c:\$recycle.bin\s-1-5-18\desktop.ini, ...
»
File Properties
Names c:\$recycle.bin\s-1-5-18\desktop.ini (Modified File)
c:\$recycle.bin\s-1-5-18\desktop.ini.[evil@cock.lu].evil (Created File)
Size 0.66 KB
Hash Values MD5: ff69eac2cc31e4046a19402004bb1b2b
SHA1: d781981daadbc0e17b95eb4296a9332ad28fd975
SHA256: bf54b068790139098829f2c4c30486d39c8aa3fbd05d4223cfe330da0a48ff4a
Actions
...
c:\$recycle.bin\s-1-5-18\!_how_recovery_files_!.txt, ...
»
File Properties
Names c:\$recycle.bin\s-1-5-18\!_how_recovery_files_!.txt (Created File)
c:\$recycle.bin\s-1-5-21-1462094071-1423818996-289466292-1000\!_how_recovery_files_!.txt (Created File)
c:\$recycle.bin\!_how_recovery_files_!.txt (Created File)
c:\boot\bg-bg\!_how_recovery_files_!.txt (Created File)
c:\boot\cs-cz\!_how_recovery_files_!.txt (Created File)
c:\boot\da-dk\!_how_recovery_files_!.txt (Created File)
c:\boot\de-de\!_how_recovery_files_!.txt (Created File)
c:\boot\el-gr\!_how_recovery_files_!.txt (Created File)
c:\boot\en-gb\!_how_recovery_files_!.txt (Created File)
c:\boot\en-us\!_how_recovery_files_!.txt (Created File)
c:\boot\es-es\!_how_recovery_files_!.txt (Created File)
c:\boot\es-mx\!_how_recovery_files_!.txt (Created File)
c:\boot\et-ee\!_how_recovery_files_!.txt (Created File)
c:\boot\fi-fi\!_how_recovery_files_!.txt (Created File)
c:\boot\fonts\!_how_recovery_files_!.txt (Created File)
c:\boot\fr-ca\!_how_recovery_files_!.txt (Created File)
c:\boot\fr-fr\!_how_recovery_files_!.txt (Created File)
c:\boot\hr-hr\!_how_recovery_files_!.txt (Created File)
c:\boot\hu-hu\!_how_recovery_files_!.txt (Created File)
c:\boot\it-it\!_how_recovery_files_!.txt (Created File)
c:\boot\ja-jp\!_how_recovery_files_!.txt (Created File)
c:\boot\ko-kr\!_how_recovery_files_!.txt (Created File)
c:\boot\lt-lt\!_how_recovery_files_!.txt (Created File)
c:\boot\lv-lv\!_how_recovery_files_!.txt (Created File)
c:\boot\nb-no\!_how_recovery_files_!.txt (Created File)
c:\boot\nl-nl\!_how_recovery_files_!.txt (Created File)
c:\boot\pl-pl\!_how_recovery_files_!.txt (Created File)
c:\boot\pt-br\!_how_recovery_files_!.txt (Created File)
c:\boot\pt-pt\!_how_recovery_files_!.txt (Created File)
c:\boot\qps-ploc\!_how_recovery_files_!.txt (Created File)
c:\boot\resources\en-us\!_how_recovery_files_!.txt (Created File)
c:\boot\resources\!_how_recovery_files_!.txt (Created File)
c:\boot\ro-ro\!_how_recovery_files_!.txt (Created File)
c:\boot\ru-ru\!_how_recovery_files_!.txt (Created File)
c:\boot\sk-sk\!_how_recovery_files_!.txt (Created File)
c:\boot\sl-si\!_how_recovery_files_!.txt (Created File)
c:\boot\sr-latn-cs\!_how_recovery_files_!.txt (Created File)
c:\boot\sr-latn-rs\!_how_recovery_files_!.txt (Created File)
c:\boot\sv-se\!_how_recovery_files_!.txt (Created File)
c:\boot\tr-tr\!_how_recovery_files_!.txt (Created File)
c:\boot\uk-ua\!_how_recovery_files_!.txt (Created File)
c:\boot\zh-cn\!_how_recovery_files_!.txt (Created File)
c:\boot\zh-hk\!_how_recovery_files_!.txt (Created File)
c:\boot\zh-tw\!_how_recovery_files_!.txt (Created File)
c:\boot\!_how_recovery_files_!.txt (Created File)
c:\perflogs\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\designer\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\clicktorun\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\ar-sa\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\bg-bg\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\cs-cz\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\da-dk\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\de-de\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\el-gr\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\en-gb\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\en-us\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\es-es\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\es-mx\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\et-ee\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\fi-fi\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\fr-ca\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\fr-fr\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\fsdefinitions\insert\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\fsdefinitions\main\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\fsdefinitions\oskclearui\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\fsdefinitions\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\he-il\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\hr-hr\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\hu-hu\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\hwrcustomization\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\it-it\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\ja-jp\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\ko-kr\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\languagemodel\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\lt-lt\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\lv-lv\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\nb-no\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\nl-nl\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\pl-pl\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\pt-br\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\pt-pt\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\ro-ro\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\ru-ru\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\sk-sk\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\sl-si\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\sr-latn-cs\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\sr-latn-rs\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\sv-se\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\th-th\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\tr-tr\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\uk-ua\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\zh-cn\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\zh-hk\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\zh-tw\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\ink\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\msinfo\en-us\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\msinfo\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\office16\office setup controller\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\office16\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\source engine\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\stationery\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\textconv\en-us\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\textconv\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\triedit\en-us\!_how_recovery_files_!.txt (Created File)
c:\program files\common files\microsoft shared\triedit\!_how_recovery_files_!.txt (Created File)
Size 0.92 KB
Hash Values MD5: 1a678d15903094d557947ab1688c8436
SHA1: 11ea9faf9b0c218dafb9b38c092702ddc1fdc33a
SHA256: 168838ba2a258a1400190b248c4e4289a8c7177490beb177c5405cd638bfb94f
Actions
...
c:\$recycle.bin\s-1-5-21-1462094071-1423818996-289466292-1000\desktop.ini
»
File Properties
Names c:\$recycle.bin\s-1-5-21-1462094071-1423818996-289466292-1000\desktop.ini (Modified File)
Size 0.16 KB
Hash Values MD5: 673801ddc146a268d8d3cf440c9824e7
SHA1: 639e8f3ca86c413f74c81e80894f025cd5192db9
SHA256: 587556cd6e2ef70fca97e9849b7dec128447db861ee4df2e05bda18d9e72d59d
Actions
...
c:\$recycle.bin\s-1-5-21-1462094071-1423818996-289466292-1000\desktop.ini, ...
»
File Properties
Names c:\$recycle.bin\s-1-5-21-1462094071-1423818996-289466292-1000\desktop.ini (Modified File)
c:\$recycle.bin\s-1-5-21-1462094071-1423818996-289466292-1000\desktop.ini.[evil@cock.lu].evil (Created File)
Size 0.66 KB
Hash Values MD5: e7a9e2351b4e218f3c99314906b11f46
SHA1: 10e559903eebe8d9be238a2ad03dd48a424fcad5
SHA256: 9141a388677affd8c6d567d52af005c3eec3c99a98c66f93197e8dc79a2f418f
Actions
...
c:\boot\bootstat.dat
»
File Properties
Names c:\boot\bootstat.dat (Modified File)
Size 64.03 KB
Hash Values MD5: 9f4300a35167c6f205ca8c7686e21e25
SHA1: 444aa340238ea046e1da6114a8cf8f7e29f9e026
SHA256: 437c70d066370cee790e3202bb2cd00bc47597b3bb6f070efcc4fbeb8bb7ae02
Actions
...
c:\boot\bootstat.dat, ...
»
File Properties
Names c:\boot\bootstat.dat (Modified File)
c:\boot\bootstat.dat.[evil@cock.lu].evil (Created File)
Size 64.53 KB
Hash Values MD5: 50243b2b79d1d5690dd322b1d329e064
SHA1: a9ae7fd51bbc77785bfb183d2d6c920c5d7db112
SHA256: 67d791f27148c0f68b50d2eefb278c99ec768376d089ca3acade72005c2a5fff
Actions
...
c:\bootnxt
»
File Properties
Names c:\bootnxt (Modified File)
Size 0.03 KB
Hash Values MD5: 67ffc5d24d1cbadf2821bd3013f7ec9d
SHA1: 4f251ba2247cc87fc01267ad4c60ca64e18e5798
SHA256: 1c939e97e3f2691da59e1b98d0b75474aa7fcf1729702e4c41c9b5c997f2427b
Actions
...
c:\bootnxt, ...
»
File Properties
Names c:\bootnxt (Modified File)
c:\bootnxt.[evil@cock.lu].evil (Created File)
Size 0.53 KB
Hash Values MD5: 58e2aeb7130d240278cdb3ce0fc4d3ea
SHA1: 79cbe8f8273d8b8efbc3d9fdcbc53c2cd2cbc075
SHA256: a584b8a913c91ac9ee4b076c0f6fb5282b4dc8bf1b31005c7a81e910e52db0ef
Actions
...
c:\program files\common files\designer\msaddndr.olb
»
File Properties
Names c:\program files\common files\designer\msaddndr.olb (Modified File)
Size 22.72 KB
Hash Values MD5: 1e5ea766fa60d7e6e4face1491b15bf1
SHA1: ef6a1eec72e9e328151c4a3b0ddc68870e960cba
SHA256: 6f0bf1b9d6442b15a8d843d2e6a9ff5d7d110d8dce57690c21edeefdb9d2badd
Actions
...
c:\program files\common files\designer\msaddndr.olb, ...
»
File Properties
Names c:\program files\common files\designer\msaddndr.olb (Modified File)
c:\program files\common files\designer\msaddndr.olb.[evil@cock.lu].evil (Created File)
Size 23.22 KB
Hash Values MD5: ff1d1cdd55d4cfd3a1907a8f1a642dca
SHA1: 85cafe710f50eb3e2500cfd0b077f33d8de7bef3
SHA256: 05f7e8e9b4885805c836bf1ad3eef7d87d12c74e5e2bb95f476bb778d9046864
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l1-2-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l1-2-0.dll (Modified File)
Size 18.22 KB
Hash Values MD5: 6b3e92a3d621563f5fc04480aeaaafe3
SHA1: 80300f3fd6649f21f979241aa97c41a6eb008a2b
SHA256: 79e266687e08c049fb814354c2c4813d95c0e5388a00f465021a347edd139694
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l1-2-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l1-2-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l1-2-0.dll.[evil@cock.lu].evil (Created File)
Size 18.72 KB
Hash Values MD5: 80e2bd3bc9d5a77013bb6046777c89ac
SHA1: fad12c60a9e182e76ae863bfd2bf44032926da9c
SHA256: aad945c447e5b5a244df47172a439747672332479e1285b00d7bca85f924f314
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l2-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l2-1-0.dll (Modified File)
Size 18.22 KB
Hash Values MD5: 779972ae5cf88549fc001b0de45be14c
SHA1: 555ff4c201bc9706d70316a3ed94ec83c24a064e
SHA256: 802bb5fff8d58e6187deb51bd5714c5aba2d6b8048e9fd3e1596e9a09398a1b1
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l2-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l2-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l2-1-0.dll.[evil@cock.lu].evil (Created File)
Size 18.72 KB
Hash Values MD5: d436cabae27c5fa1f752147792594be7
SHA1: 1a5408e7a8cba6b2bc4eff5b71e744226b28f2ca
SHA256: dfba80d16d1930a1a7869eb21116eb8d741c23dd6cd4b2ca3d57c5073e47a85a
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-localization-l1-2-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-localization-l1-2-0.dll (Modified File)
Size 20.72 KB
Hash Values MD5: c65396d37f4af22dffac7cf70d523346
SHA1: 1ae5b4d5f37a809cd6b1f3bea673cbd2a0bc21bf
SHA256: 7e2a4ac6c6a30544d1ca05c27805df90687cc3418b417eefb4d3f4db3cd70d3a
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-localization-l1-2-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-localization-l1-2-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-localization-l1-2-0.dll.[evil@cock.lu].evil (Created File)
Size 21.22 KB
Hash Values MD5: ea976dd633bde33f2e83da02d4d33d53
SHA1: fed328a42394ac0204b584ce0f1698eff82620ae
SHA256: f0d439f3b4f04286f34dbfd12e779c7a4e47b8b02fabb6bbf84579b26c2c32eb
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-processthreads-l1-1-1.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-processthreads-l1-1-1.dll (Modified File)
Size 18.72 KB
Hash Values MD5: 81fc43f8895b734da1c0ce9f58fc2f8e
SHA1: d2bb68b5bb7d81d0a43f8d18074e4b40029d9ca9
SHA256: 9be9286cb594e7ebb025eeb52a02fb31e62f092dd7ebc2c84925d7c2325907dc
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-processthreads-l1-1-1.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-processthreads-l1-1-1.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-processthreads-l1-1-1.dll.[evil@cock.lu].evil (Created File)
Size 19.22 KB
Hash Values MD5: aab8b18f63dbc88e289040a664dd0534
SHA1: cb365c7fe3f9e104cd2b23aa46f514f3fa21ef17
SHA256: e4ce47e733e84dcff65db781b69339c6b16d4b12f580694663ddfa7f3a1c72f2
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-synch-l1-2-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-synch-l1-2-0.dll (Modified File)
Size 18.72 KB
Hash Values MD5: a5dc5f43c24d2c580d6b3413d251ccee
SHA1: 6db620ef9cf8ea0016b30d14dd3dadc41268515e
SHA256: a9b715f6a427a7ee724fb8b61644e8684ef7636a1d01e3787db52a33217f037c
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-synch-l1-2-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-synch-l1-2-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-synch-l1-2-0.dll.[evil@cock.lu].evil (Created File)
Size 19.22 KB
Hash Values MD5: 9b2078bdaac5334cb3694a82be5a4801
SHA1: 44ab13e0d3f8d4b8eea44a5d85436c08a1c9dd99
SHA256: 6b615bf3e093815dc9c07d5d7122d30a3ce8b0ff7e660609502364d0c32cd722
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-timezone-l1-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-timezone-l1-1-0.dll (Modified File)
Size 18.22 KB
Hash Values MD5: 9bc9dc13337ad3e0a684bb662d2cfe5b
SHA1: c5aff84cf0b061e980e2779775e579309fb027f2
SHA256: 2ef34ba36d561782429118e8e7927e62f1d869a1b8126842f79293791798f617
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-timezone-l1-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-timezone-l1-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-timezone-l1-1-0.dll.[evil@cock.lu].evil (Created File)
Size 18.72 KB
Hash Values MD5: 47fba4c9e3ee095b3a97e5c29ddff551
SHA1: f5d26fc32a23e9e02317fda3f52f7c74f04be829
SHA256: b0f286eda0ea1cc2a2506723bb844936823bb6d5244db56b13a870a1818bcec1
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-xstate-l2-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-xstate-l2-1-0.dll (Modified File)
Size 11.38 KB
Hash Values MD5: 519678d26665cffd9b2dac777dc539c3
SHA1: 8dce916c3b94ae1c7e2d89d463ad35a431f31be8
SHA256: c238b728e458399b64e0469c6a479fd1235daac5d7a1fc022a3fd4868fe78413
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-xstate-l2-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-xstate-l2-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-xstate-l2-1-0.dll.[evil@cock.lu].evil (Created File)
Size 11.88 KB
Hash Values MD5: 3c2a465c0664d7854a7caec13943834a
SHA1: 9ed94930babf688a8fa54df519424f5601c7a799
SHA256: 19d946d3d2b633f0bb8e2fa40a446082917feceaae3300d1d384c286c01540ef
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-conio-l1-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-conio-l1-1-0.dll (Modified File)
Size 19.22 KB
Hash Values MD5: f64bbae1c7e56a55bdafc6776ec6f2f9
SHA1: 8aa04faa21596508e30b9d386a5800e53a62f338
SHA256: 0b9fd05b7623788fef4295610917f84055f71d84f1c7e5f24e4579d3c8ae7fb0
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-conio-l1-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-conio-l1-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-conio-l1-1-0.dll.[evil@cock.lu].evil (Created File)
Size 19.72 KB
Hash Values MD5: 67e08d1bc4a8ceb4849bbb7490a5ef36
SHA1: 0e2ac3fe8228b655755456d864e2d46fb13be944
SHA256: 45d86f3aaeb598812a8c3ef73b518a4343c04c1a3a24a641e6ff442a117b2194
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-convert-l1-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-convert-l1-1-0.dll (Modified File)
Size 22.22 KB
Hash Values MD5: 9d9e9f011eb5e57b1aad403381db2dc0
SHA1: 877c9c87489aec11203d5eef8e8eec7cf043d409
SHA256: 2cbb299a48d862a70be7da3ad933c43fb94a8e15b0ad181a50f8839fc0a37cee
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-convert-l1-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-convert-l1-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-convert-l1-1-0.dll.[evil@cock.lu].evil (Created File)
Size 22.72 KB
Hash Values MD5: 95dab35641d78b80984ee8837a503e69
SHA1: 5321f924b0b8829ad943d28df03837761f16644d
SHA256: d12372aa9f9d48f064853e91adcb826d16d30898b7c3aecb55d3ef90585cc03d
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-environment-l1-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-environment-l1-1-0.dll (Modified File)
Size 18.72 KB
Hash Values MD5: 119ac6212daf36c303ae53bca3cf035e
SHA1: 11213e766612322554807b8ee6d125e349403f45
SHA256: cddbd1c9826ba8aa3516e1e1a9c562722dd94265c0c390a445e189a8997b3e4a
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-environment-l1-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-environment-l1-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-environment-l1-1-0.dll.[evil@cock.lu].evil (Created File)
Size 19.22 KB
Hash Values MD5: cf0b902b894a27d185524839e0af804b
SHA1: c457940cdbc533078e14d59702ce7b07059a965c
SHA256: ca43590e2e64f419f68a6b5546e0609b22eac23cd567c21de43897e903e72c67
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-filesystem-l1-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-filesystem-l1-1-0.dll (Modified File)
Size 20.22 KB
Hash Values MD5: 6d3a3bb0a64f198f9278db68be7bd5b9
SHA1: cb18b048ddec64df6129550bc9b34b786f7d1e0b
SHA256: ccad0a97fc886be55942af0b43ec91c34ed0eb4e42637bca50e80ba071ec034a
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-filesystem-l1-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-filesystem-l1-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-filesystem-l1-1-0.dll.[evil@cock.lu].evil (Created File)
Size 20.72 KB
Hash Values MD5: e538f31045b39cf753cce41ec066ff56
SHA1: ff39f7f1071e41aefa2a969bc98b10b2f60c66e8
SHA256: 9fd8e19b1a05f30211cb11ed6ed5c92e8351754609fc5e2c8e7effaec017f2fa
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-heap-l1-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-heap-l1-1-0.dll (Modified File)
Size 19.22 KB
Hash Values MD5: 3dfb813bb1c17383e5d3e24679e42065
SHA1: f4f269ac8bfa6af863ae9a86505b9cf321f052f2
SHA256: 4fa719a172f024a02ed11f16720cf5b35fe438ff0788750b76bf9f06a5759201
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-heap-l1-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-heap-l1-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-heap-l1-1-0.dll.[evil@cock.lu].evil (Created File)
Size 19.72 KB
Hash Values MD5: f611a1acac4c63fc5786c0cfe3139553
SHA1: f12fd7a3fc9b4ee730dcd8f4b8d308c177151530
SHA256: 6893e37380a932199ca8bdd42eef23156e46477e795012e18f84210023e04cf2
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-locale-l1-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-locale-l1-1-0.dll (Modified File)
Size 18.72 KB
Hash Values MD5: 84206093e1d550162f03bea0c50d2054
SHA1: 550e5015bf2e7ddb71f46315ffc5339ae083c46f
SHA256: 53b60c7078a4a091219127ccb198ea5ca6e63423ece1a0908f97b085ac96bc7b
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-locale-l1-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-locale-l1-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-locale-l1-1-0.dll.[evil@cock.lu].evil (Created File)
Size 19.22 KB
Hash Values MD5: 11ddfdff6ced2b90a17d0a45f4725dfb
SHA1: 945bb2696bb13e90139d957d8e00f4794a560844
SHA256: 393aeebd06dd64f06c7d284cdb9b3e52f5cca6405c273f14cf844f00fba4a2f3
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-math-l1-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-math-l1-1-0.dll (Modified File)
Size 27.22 KB
Hash Values MD5: 555db3d4cd2cc7e833dba9f4b17a492f
SHA1: fdd49bf881a4b7bd2e1f77c96816dc95b49782b0
SHA256: c88a5653b2b7fd91e9d7cabe6e0c562bfdb5ffe94f8d22aab5053c1b11eb652f
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-math-l1-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-math-l1-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-math-l1-1-0.dll.[evil@cock.lu].evil (Created File)
Size 27.72 KB
Hash Values MD5: f0365f9f1529305bb818a06b8c7e42f3
SHA1: 3078dad668be5810a26628560a5d35e94923a07f
SHA256: 95bcb3efc918d5dcc200981ea06b0f0bc4317aac2db05b110c542ad5f38f8ec0
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-multibyte-l1-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-multibyte-l1-1-0.dll (Modified File)
Size 26.22 KB
Hash Values MD5: 482faa5624013720b7caa0f9808a7857
SHA1: db160d77dcadc15b2b3b284275ee8cd2acb2a9aa
SHA256: 6d4b09d84d5dedd49a64184797b871ef93477ea70ea5e4cfa452ea986aea7652
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-multibyte-l1-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-multibyte-l1-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-multibyte-l1-1-0.dll.[evil@cock.lu].evil (Created File)
Size 26.72 KB
Hash Values MD5: 3652e7ed09e9cb47534010d2ef450021
SHA1: 26012cb9acd993e2356cffb1549b26f08959c6cd
SHA256: 47a815497a58a0d77784908e518b38aba384eaa9e9b28885a22f3016efab8999
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-private-l1-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-private-l1-1-0.dll (Modified File)
Size 69.22 KB
Hash Values MD5: 2558b028ee0695f6304b38afba52fb8f
SHA1: 18a62a42c77a78f26cc1e44931fc56594d9db510
SHA256: a0fae81d031af02669e7c2dd1c982818e16a42fd5789a02ce42a640a1ecadb24
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-private-l1-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-private-l1-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-private-l1-1-0.dll.[evil@cock.lu].evil (Created File)
Size 69.72 KB
Hash Values MD5: af0ffdd9d0c0c55596497cd8cea4b11c
SHA1: 26d1ebb9de4a7268d9f3800a490d56fdb0b4f4a9
SHA256: 7899c07d5d1baab9e416dc0c890ab8b36de95e52759741d834f34fb69e5f0c6a
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-process-l1-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-process-l1-1-0.dll (Modified File)
Size 19.22 KB
Hash Values MD5: d90812d69d6ba1f72b5292a64b4e6594
SHA1: 4cb4d4b4ade8c1c00ecda5441d60200331d0157a
SHA256: 3a35f241ac579f6bf4d08f1e2ff12bb79dc584b6d75b65335c2451991b0784db
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-process-l1-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-process-l1-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-process-l1-1-0.dll.[evil@cock.lu].evil (Created File)
Size 19.72 KB
Hash Values MD5: da4622a7adcff855a3675dfc57644912
SHA1: 4da0ca006ba62630055b6dcb5d6eb6c0cf99e51f
SHA256: 2667857d8d19923eea1479fae3c3a437908948103749e8d2cc4c8e4228656fed
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-runtime-l1-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-runtime-l1-1-0.dll (Modified File)
Size 22.72 KB
Hash Values MD5: 407b6de0a0b08f5ec9f4441f396f1b88
SHA1: 1b4be073b5586867e8732f8785b6762f33135c1e
SHA256: 26cbdec8b437ea46ce95cdd52281974d7c22a6f98ede29830f0026eafbc16e34
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-runtime-l1-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-runtime-l1-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-runtime-l1-1-0.dll.[evil@cock.lu].evil (Created File)
Size 23.22 KB
Hash Values MD5: d0e0fce3416effea238df1be74f39606
SHA1: 5439ee05b9860228dbf5360d077cb212beabca1c
SHA256: 44ce8fe21f5e85672a08c518ff118be3dc6dd3bcb5a7398eb6ba53cd79b4cf0b
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-stdio-l1-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-stdio-l1-1-0.dll (Modified File)
Size 24.22 KB
Hash Values MD5: 889200325ccf5b8679c8d9a187af324a
SHA1: f6eca62adec81a8ee05714a74990ad2ef5b8e003
SHA256: 767c71c7132e2d33dfcb977bb028bf4db90b6056c5cd650df14aafd9c4c818e1
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-stdio-l1-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-stdio-l1-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-stdio-l1-1-0.dll.[evil@cock.lu].evil (Created File)
Size 24.72 KB
Hash Values MD5: e93894cbdbd8b70bae1b30178f523fb9
SHA1: 3c5754c5fa9c0f2c2c305f216c3f904d399a284b
SHA256: 4a1ac1dd5be1aa2a45572d0aca4e8121b923bcfe0951cb8ceca014b16c3dd246
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-string-l1-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-string-l1-1-0.dll (Modified File)
Size 24.22 KB
Hash Values MD5: 2af6ce2fd6203db52315897962301f2b
SHA1: f8cb70a4b024f6c2b235eda4c828418a7899a226
SHA256: 48924c526162f27790e47e0619cdfd0ca5874dbf34f8805cab5b9068b4da0737
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-string-l1-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-string-l1-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-string-l1-1-0.dll.[evil@cock.lu].evil (Created File)
Size 24.72 KB
Hash Values MD5: 22589347ead8d6db53234fa315905bd9
SHA1: 8ebd2422fe2d7b3bedbc5b9ba685feac26136e9f
SHA256: 5c462cc6b6cb919ec477588acc854137d4153c938dc72c4d366d65937ddf997c
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-time-l1-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-time-l1-1-0.dll (Modified File)
Size 20.72 KB
Hash Values MD5: b4f1a1b3198e723a9de33edd33a9b8e9
SHA1: 960f1d0f761368319401e4f448b0c3d51e27892f
SHA256: f798eeba34415987735055dd8625a0b54956114f14a23f29de65a879ee63974b
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-time-l1-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-time-l1-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-time-l1-1-0.dll.[evil@cock.lu].evil (Created File)
Size 21.22 KB
Hash Values MD5: 8f40f0ed2ab89381d6d78af6ef04bc50
SHA1: d95cbefa6677323e653d889c783319fb58887d11
SHA256: 28e4dc16515516b44b0f7722a707d48fcedd71a02dfc25219b8e7d524c0576c9
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-utility-l1-1-0.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-utility-l1-1-0.dll (Modified File)
Size 18.72 KB
Hash Values MD5: 37aaa850b61df6fc0828f136933ca248
SHA1: 71eda0a0f451764a7c7933f761f6c9b989b46daa
SHA256: d0894dd8743efde774294792f324244815d374faeefc7ba11e54df8a98df4bc5
Actions
...
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-utility-l1-1-0.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-utility-l1-1-0.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-utility-l1-1-0.dll.[evil@cock.lu].evil (Created File)
Size 19.22 KB
Hash Values MD5: 67e3ea5f5110b2453a28d097e969fd31
SHA1: 32908f74faf5441bef7aaf4f1eb5a28fd633685a
SHA256: e479622019da2dfda5a9aa7ba832489a0140bc806fc4be5509b7c45b2fa9371b
Actions
...
c:\program files\common files\microsoft shared\clicktorun\appvcleaner.exe
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\appvcleaner.exe (Modified File)
Size 1.97 MB
Hash Values MD5: 6027ccbdead70fb915eac49b466badc5
SHA1: b9572f13309740f95da93ad46def329675b1c9af
SHA256: e3207c21c462991a2e8d3c68011428b515beb44014ca4afed945f85605620094
Actions
...
c:\program files\common files\microsoft shared\clicktorun\appvcleaner.exe, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\appvcleaner.exe (Modified File)
c:\program files\common files\microsoft shared\clicktorun\appvcleaner.exe.[evil@cock.lu].evil (Created File)
Size 1.97 MB
Hash Values MD5: 798e2f736c7cff67d246e0c76cb5f8af
SHA1: c8d9977a044b7a80acfed9ed8c0b34506b6a64c9
SHA256: 04a094dd3d4722cdf5d2ff2763bad9d2eb731dafeff844dfcdb737d373eb7f5a
Actions
...
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems32.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems32.dll (Modified File)
Size 1.70 MB
Hash Values MD5: b67a94e1f1c4d5d24ffd41e348e26657
SHA1: 503d51d8a1e867793a38ec969f1399587aa9e7d3
SHA256: 856631a07fccd3c8f20477045c7e01474ff383694b615d772606adb655de5309
Actions
...
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems32.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems32.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems32.dll.[evil@cock.lu].evil (Created File)
Size 1.70 MB
Hash Values MD5: 9a601b7b2158505d006a171986ef835a
SHA1: e2b3d502b993a4d6ca428f5b0c994ee31801492b
SHA256: af2bc351a25276f704f75a75fc71f8e91fd2ebf5d799cf1bf2500640ea30cc83
Actions
...
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll (Modified File)
Size 2.20 MB
Hash Values MD5: f0bcba312f393291db4e966b458fb93d
SHA1: 7397c386c625e812b1ca2dc3f72b9ef5c2070b6c
SHA256: 66ee14a1799311eaa480c2b09a9c044f948675f8177fe44d541de0136e5d6a21
Actions
...
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll.[evil@cock.lu].evil (Created File)
Size 2.20 MB
Hash Values MD5: 9ffa2cd9ec3cccaa04568ee117d57d6c
SHA1: 12369c68343db424f4efb548d160e54a65a39aa0
SHA256: 2e851436be23b16d3e3a1de37e0cf076bf86dee12a9a2324fe236283587f0b65
Actions
...
c:\program files\common files\microsoft shared\clicktorun\appvscripting.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\appvscripting.dll (Modified File)
Size 509.31 KB
Hash Values MD5: 56e489a3d8a884ef3b7d0b76848da0d0
SHA1: 9ba7928013ced1099795d867eecf707bb8d2a948
SHA256: 05f83703cf11d6c58bc49042467aeef2fcb8b7bfddb859c77ed65cce5124de18
Actions
...
c:\program files\common files\microsoft shared\clicktorun\appvscripting.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\appvscripting.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\appvscripting.dll.[evil@cock.lu].evil (Created File)
Size 509.81 KB
Hash Values MD5: 70d48138b5da3567248670cd270c1fb0
SHA1: 3f45a6eeabe11b24fd550f0709e2138ebcec1d9e
SHA256: beebc01db0d751c96883a10a606d806a72f6740ffce9fcbb7d54b3632fa11731
Actions
...
c:\program files\common files\microsoft shared\clicktorun\appvshnotify.exe
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\appvshnotify.exe (Modified File)
Size 266.81 KB
Hash Values MD5: 8264358de406b51e8435be67dd708e2f
SHA1: edf65c840d8a43e8f771b72dad6076a8ac5eba64
SHA256: cd862444e9f5488758cb30b2e844ac98ecd45de26a177435bfd4f24fb7e3a2ee
Actions
...
c:\program files\common files\microsoft shared\clicktorun\appvshnotify.exe, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\appvshnotify.exe (Modified File)
c:\program files\common files\microsoft shared\clicktorun\appvshnotify.exe.[evil@cock.lu].evil (Created File)
Size 267.31 KB
Hash Values MD5: c0bc46143f5466c07262145a6f1d307b
SHA1: 8b15bf511391585a2f006294790377ef9f8f3b9a
SHA256: 900450dc443e2b38594476377d6c783a0fae86450d455534c921e86eb0e999bb
Actions
...
c:\program files\common files\microsoft shared\clicktorun\c2r32.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\c2r32.dll (Modified File)
Size 1.41 MB
Hash Values MD5: 20b9fefef918d1a2269a44a92be227c0
SHA1: 0db482cf5f8ce1f1e6e613d7d6afaddf42b764c2
SHA256: 9584f86e54f294244f5048a995836a7cd3593f686abf8bc7055a8ff30049b46e
Actions
...
c:\program files\common files\microsoft shared\clicktorun\c2r32.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\c2r32.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\c2r32.dll.[evil@cock.lu].evil (Created File)
Size 1.41 MB
Hash Values MD5: 9a728740c51ac0bb2c7ce65554d7442e
SHA1: ce8bff9f569250a811858aeb5f424095906bfcfb
SHA256: d4ac54a070b75196276e7e94f55a41cf93a7243026a8c307a3b4a7a13c5a5f02
Actions
...
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\c2r64.dll (Modified File)
Size 1.91 MB
Hash Values MD5: d9579ddc97c0cbbb413ac8412d41d5bc
SHA1: 69df576875fa5eefbd1286b4528f5d012964cd76
SHA256: 58f7a02870a57e77fb513be0638dd67ecded80d102192804ccbe174b96019a03
Actions
...
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\c2r64.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll.[evil@cock.lu].evil (Created File)
Size 1.91 MB
Hash Values MD5: 12f7046a4641bc31ff58effd75ba1895
SHA1: 521e4ca34bb4e5a6d7488d00e189c810a016635b
SHA256: 2d257c207a6436b99a90e6012d68f94284c18f07662c37b7ccc20a099201c6cb
Actions
...
c:\program files\common files\microsoft shared\clicktorun\c2rheartbeatconfig.xml
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\c2rheartbeatconfig.xml (Modified File)
Size 4.06 KB
Hash Values MD5: e96e4ff0085f650a36adf53661ea2c6d
SHA1: 952324ab999e8a4fd9365fc5d47497dc65c64056
SHA256: dec7e4a0bf4e20691c89ad8b1fa1664f18d4a5342763ba594de2c114752e7d5b
Actions
...
c:\program files\common files\microsoft shared\clicktorun\c2rheartbeatconfig.xml, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\c2rheartbeatconfig.xml (Modified File)
c:\program files\common files\microsoft shared\clicktorun\c2rheartbeatconfig.xml.[evil@cock.lu].evil (Created File)
Size 4.56 KB
Hash Values MD5: b54cd29fbcd2d4310bfc41857d844ef5
SHA1: 01278c4c2a3f3b8128b35cdbaf7ccdaf53454202
SHA256: 9591fa562b47730d4890a5922f7dd672d535ef3234b5a224ebba15b991ea7b2f
Actions
...
c:\program files\common files\microsoft shared\clicktorun\c2rui.en-us.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\c2rui.en-us.dll (Modified File)
Size 995.72 KB
Hash Values MD5: 743f2cf50e33ab2f1f691aeee54e512e
SHA1: a4aad9be7994d73ab099a5b4d3317c4f9527723f
SHA256: 2760ed8f41dded3b194fa483fbc27e2b9bbc7069f247c2448db7e9d3368ddb48
Actions
...
c:\program files\common files\microsoft shared\clicktorun\c2rui.en-us.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\c2rui.en-us.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\c2rui.en-us.dll.[evil@cock.lu].evil (Created File)
Size 996.22 KB
Hash Values MD5: 293034391c2308f7c264d8d791a8dd7b
SHA1: 1c4f3afa6fc72386e3ce561dad3ae213ad68e35d
SHA256: 33d882c1a391a4b6165358b08445cc7d4a49993022c21241bd542b25dbfbcbc1
Actions
...
c:\program files\common files\microsoft shared\clicktorun\clientcapabilities.json
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\clientcapabilities.json (Modified File)
Size 0.06 KB
Hash Values MD5: 2e2a6bdd1418f77d2ab93d905ec68b5d
SHA1: c19b16d37ca7dcc4c82e5563d916dbb15a020b7c
SHA256: 9bd23c08809b3f6581cc2cf19401edcfab0ce5c029dea637e4a995303aa8f160
Actions
...
c:\program files\common files\microsoft shared\clicktorun\clientcapabilities.json, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\clientcapabilities.json (Modified File)
c:\program files\common files\microsoft shared\clicktorun\clientcapabilities.json.[evil@cock.lu].evil (Created File)
Size 0.56 KB
Hash Values MD5: a37b2c6151903d7b1ab335c4878d8063
SHA1: cc5d12c5313da03c4901554646a660b12fb7d003
SHA256: d45429e042efc50ae1c4e847f336578fc44af08bf5e24bd517919478c0727602
Actions
...
c:\program files\common files\microsoft shared\clicktorun\clienttelemetry.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\clienttelemetry.dll (Modified File)
Size 1.80 MB
Hash Values MD5: 7bfe1b629ac24d45bdba77d620abf237
SHA1: 4d24cb21b71ccc3f0a46dbf6827f3e67dda9c82a
SHA256: 71d45980241e28dbd0ef503fbebcf697b357bc19c21120ce6391cc05b4ab3f46
Actions
...
c:\program files\common files\microsoft shared\clicktorun\clienttelemetry.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\clienttelemetry.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\clienttelemetry.dll.[evil@cock.lu].evil (Created File)
Size 1.80 MB
Hash Values MD5: 6da1c6a666477ea4e50cecf13b3dc7e8
SHA1: 89d66e132b1ec0b9685cdd12da48e7cb789c02da
SHA256: 60e3dbbe83f2ef4b279eef3954c2f66465e1cd539c940198535f1bb27a84d11c
Actions
...
c:\program files\common files\microsoft shared\clicktorun\concrt140.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\concrt140.dll (Modified File)
Size 325.84 KB
Hash Values MD5: 171f8b38cb063e41d2977e1c79d64b28
SHA1: 078e05658b13d0ce2dfa170f48b3f3485965c63c
SHA256: c57c8782ea54455ce47e7c1d32ccfaa0ed6c359594660d487b33a6281839e070
Actions
...
c:\program files\common files\microsoft shared\clicktorun\concrt140.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\concrt140.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\concrt140.dll.[evil@cock.lu].evil (Created File)
Size 326.34 KB
Hash Values MD5: 42f008163f211a3d9753a8d4b5561990
SHA1: 16c7776f9ee410cdada5f39b894dc9ea022015ce
SHA256: 8456cd026791091d0f368ef51a206e3816e8f3b4585fc761fa06426445005e9f
Actions
...
c:\program files\common files\microsoft shared\clicktorun\i640.hash
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\i640.hash (Modified File)
Size 0.12 KB
Hash Values MD5: a1cfd27bc2177ced277eb1827158188b
SHA1: 5c90eb275863150bf7fe60c5b175f313fdd887a6
SHA256: 68f7b1a51178dfdf7517fa39399aa2cc46a74521b1751a31b61dee693c5fc9f3
Actions
...
c:\program files\common files\microsoft shared\clicktorun\i640.hash, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\i640.hash (Modified File)
c:\program files\common files\microsoft shared\clicktorun\i640.hash.[evil@cock.lu].evil (Created File)
Size 0.62 KB
Hash Values MD5: 3fc8fdbf027de2d36452b2f675b55bc4
SHA1: 9167114c74a73b08523e219016532f851b5f5555
SHA256: e209e64a505af38c06e787c81b6bee4257b4356fd3d3f4717dca8a2540e77634
Actions
...
c:\program files\common files\microsoft shared\clicktorun\i641033.hash
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\i641033.hash (Modified File)
Size 0.12 KB
Hash Values MD5: c5a8ef650a72b24d12530105224a0e6d
SHA1: ea5c3765b44028d3bd8c9c7b22b67354ce1261a1
SHA256: 718c23112800c4aef4b977484f12b1d9a2018117cb739a07da85d61aafd78f0d
Actions
...
c:\program files\common files\microsoft shared\clicktorun\i641033.hash, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\i641033.hash (Modified File)
c:\program files\common files\microsoft shared\clicktorun\i641033.hash.[evil@cock.lu].evil (Created File)
Size 0.62 KB
Hash Values MD5: a23ff618276a9b318024879899d891f7
SHA1: 6df3b85d5697c19a68a10b9c2e16003f645ef88e
SHA256: 17e45046f7d6df4ffe7b069a705e84a35990cb2c937f660f6042d4a744c55744
Actions
...
c:\program files\common files\microsoft shared\clicktorun\integratedoffice.exe
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\integratedoffice.exe (Modified File)
Size 4.24 MB
Hash Values MD5: 83d89d29eb85c561bf1502a583ac5c39
SHA1: 1fc458c72c0ab6eeb6f093f01bbd35f1aab2aea0
SHA256: 9082ecf2918986569161152df29e052127864585322eca5339104ba2c47f65b0
Actions
...
c:\program files\common files\microsoft shared\clicktorun\integratedoffice.exe, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\integratedoffice.exe (Modified File)
c:\program files\common files\microsoft shared\clicktorun\integratedoffice.exe.[evil@cock.lu].evil (Created File)
Size 4.25 MB
Hash Values MD5: b36588295248143016f586de036ae9bb
SHA1: 086090e27b23aeaec6a042a3e56952a24335990c
SHA256: ca66fdf37af38599cae97513b6c22c7345bb27191e73a487402f92bfb9f16e81
Actions
...
c:\program files\common files\microsoft shared\clicktorun\mavinject32.exe
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\mavinject32.exe (Modified File)
Size 359.31 KB
Hash Values MD5: 12af5da90c720697908771691335bf63
SHA1: 18c935ccd76bd9cb6cd0461f20e986d446536105
SHA256: ef122b1d3730ef1c930689eb991fe33d00f75ef8f935b9ed86212ae9afc14b04
Actions
...
c:\program files\common files\microsoft shared\clicktorun\mavinject32.exe, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\mavinject32.exe (Modified File)
c:\program files\common files\microsoft shared\clicktorun\mavinject32.exe.[evil@cock.lu].evil (Created File)
Size 359.81 KB
Hash Values MD5: cdda122d5337742b76a7f0d6074fa0ea
SHA1: 28618a6b6400f31b080eb03308d944267dea9012
SHA256: 42f2a8ce2f78d7c8f853b8d87ff8eec49a1a8f290b26ed7a96cb70c8bacf81f8
Actions
...
c:\program files\common files\microsoft shared\clicktorun\mso20win32client.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\mso20win32client.dll (Modified File)
Size 4.46 MB
Hash Values MD5: 92944c5cac195440a73bdda2cb9e70df
SHA1: a007764b6ddee8b03e21721dea1491af956f8a46
SHA256: 0a822877e61860db36b6009a52bbfdcbfd8a3f7eb7460a6329edd15484c35a93
Actions
...
c:\program files\common files\microsoft shared\clicktorun\mso20win32client.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\mso20win32client.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\mso20win32client.dll.[evil@cock.lu].evil (Created File)
Size 4.47 MB
Hash Values MD5: 17fb0a91befd68074e760fdbea847f21
SHA1: 60bee8cb5a15bf5fdcbbf34dddc64204e6e625e4
SHA256: e561acb707294432007fe060a4c9e08891b2d540e3c37c04aa6fb84dc81553e8
Actions
...
c:\program files\common files\microsoft shared\clicktorun\mso30win32client.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\mso30win32client.dll (Modified File)
Size 6.80 MB
Hash Values MD5: 3b27772cf5ddf3610df20d4f35670cb8
SHA1: 89a8ad07cd0d8cbe1a1c1895d5f82eff13243d03
SHA256: b0382917ad1cb3a384492f8c30210e5749d17c47f31266ec6e8fa5e50a76ce63
Actions
...
c:\program files\common files\microsoft shared\clicktorun\mso30win32client.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\mso30win32client.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\mso30win32client.dll.[evil@cock.lu].evil (Created File)
Size 6.80 MB
Hash Values MD5: 6141afd2b7bf8e8877afd43193cf963c
SHA1: 88481e75bbfca1ce5cdbef10a478cfc3a8a667cb
SHA256: 3ebfbb607575862de9a6786869d41cc19bbc001369dc2402500bb7bd110757de
Actions
...
c:\program files\common files\microsoft shared\clicktorun\mso40uires.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\mso40uires.dll (Modified File)
Size 4.25 MB
Hash Values MD5: 902f00ec22f5dbeae25b11a6ea73b0b1
SHA1: 0d6c10cd93df8d2c2b67863db8e827d93b157a94
SHA256: f9ca9431378a1d46820108152c4cd2c705fa88c3566c2e8ec5213ee63df232f4
Actions
...
c:\program files\common files\microsoft shared\clicktorun\mso40uires.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\mso40uires.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\mso40uires.dll.[evil@cock.lu].evil (Created File)
Size 4.25 MB
Hash Values MD5: 65a7ac99d4e754417d615a931b20bad5
SHA1: ed63089422affd7d6ba19540c6ae56bb9f4a810c
SHA256: 981f504e223de0b97c445cb2afda256523201a89dece9a1321051b57fae3fcef
Actions
...
c:\program files\common files\microsoft shared\clicktorun\mso40uiwin32client.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\mso40uiwin32client.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\mso40uiwin32client.dll.[evil@cock.lu].evil (Created File)
Size 10.00 MB
Hash Values MD5: bd3874610ed589e1439875c32e385129
SHA1: 3a3a825597681612bb9e0ed75be392ee22af7c49
SHA256: 144cfb403b540c0a44a91db61c942ea588c6eba2adbfcfbde76901c7378c4e86
Actions
...
c:\program files\common files\microsoft shared\clicktorun\msointl30.en-us.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\msointl30.en-us.dll (Modified File)
Size 74.22 KB
Hash Values MD5: 8a3c1fb38600add796c8d9750e55a359
SHA1: 997037365ffe06d12ddecdb2e8e036dce12279a2
SHA256: a2ffe2bc744a196a9272c8d6a7fa02b18861edd9e2044457566d0e87e04a21e4
Actions
...
c:\program files\common files\microsoft shared\clicktorun\msointl30.en-us.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\msointl30.en-us.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\msointl30.en-us.dll.[evil@cock.lu].evil (Created File)
Size 74.72 KB
Hash Values MD5: 1430797492e4d47dedc68ac94d9ee7aa
SHA1: f5716d4a7cf8bb47727fa0fcf24950ed3ae6d0be
SHA256: 3497699cbf5582db1dd7857b817c3dff25297f38b2a72dec98d041a7e449e4ab
Actions
...
c:\program files\common files\microsoft shared\clicktorun\officec2rclient.exe, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\officec2rclient.exe (Modified File)
c:\program files\common files\microsoft shared\clicktorun\officec2rclient.exe.[evil@cock.lu].evil (Created File)
Size 10.00 MB
Hash Values MD5: ffc949a2e16a51b2102435f917301298
SHA1: 79e54a06f4abdde1a22247678c589982524ca16d
SHA256: 6717ac0e398fb619b4de5dddbeb7b684ac0f2d0dfeb2408b55eaed3b5be68547
Actions
...
c:\program files\common files\microsoft shared\clicktorun\officec2rcom.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\officec2rcom.dll (Modified File)
Size 1.78 MB
Hash Values MD5: 4f657be92303284be973221f8f306211
SHA1: 3260bca376da07c5a706e7ffb690543b2ee18950
SHA256: c78e9dbd833fd4233ddfa2b53d2540bad73b531e398779e57f8a883424c59a26
Actions
...
c:\program files\common files\microsoft shared\clicktorun\officec2rcom.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\officec2rcom.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\officec2rcom.dll.[evil@cock.lu].evil (Created File)
Size 1.78 MB
Hash Values MD5: bc11d384f7a1c90d483a4a934ae875b8
SHA1: 45e3ef8ae40bd6e31b164c37c6050d837751cd86
SHA256: 3aa068fc7ae301a9132da6bb198a34452892afc9f8d9f23b284a19cf81dec03f
Actions
...
c:\program files\common files\microsoft shared\clicktorun\officeupdateschedule.xml
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\officeupdateschedule.xml (Modified File)
Size 4.69 KB
Hash Values MD5: db85a4af94fa3f3379249d58d0d5e316
SHA1: 583f4252e10b6aaa27bf9a0b4cb90ef40e40e5db
SHA256: 77e8b5f77a0fd015610d5df466b2826f7365bb439902588ce9ea098bd60b2218
Actions
...
c:\program files\common files\microsoft shared\clicktorun\officeupdateschedule.xml, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\officeupdateschedule.xml (Modified File)
c:\program files\common files\microsoft shared\clicktorun\officeupdateschedule.xml.[evil@cock.lu].evil (Created File)
Size 5.19 KB
Hash Values MD5: 313a782e52ee105db21a0439d0ba1e44
SHA1: 1c888cdbd58c53a68fe5807bd442335f3b33f156
SHA256: 5eddd5defdceb6a1c81c0002c72c4d0f9ab96f8b42e21ece80d0d724873a4690
Actions
...
c:\program files\common files\microsoft shared\clicktorun\servicewatcherschedule.xml
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\servicewatcherschedule.xml (Modified File)
Size 4.38 KB
Hash Values MD5: 77af118790fba5c150190009441c6a4d
SHA1: 8915b7f5bb4f49e3937d9efa4425096d4c3567f2
SHA256: d63a504fdcf5f79f06b05c4e65de569f4331d9330675f5da21ec1d1d67c8d49c
Actions
...
c:\program files\common files\microsoft shared\clicktorun\servicewatcherschedule.xml, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\servicewatcherschedule.xml (Modified File)
c:\program files\common files\microsoft shared\clicktorun\servicewatcherschedule.xml.[evil@cock.lu].evil (Created File)
Size 4.88 KB
Hash Values MD5: dcbf870231565ceb0922ccd875060668
SHA1: 3ac83c3fc9deca8c8670b0d19d2df094c4b15855
SHA256: 35c0e41548767ec419ed99460d1904495cb6d1b689d15c1ccc8d8d2b6c275294
Actions
...
c:\program files\common files\microsoft shared\clicktorun\ucrtbase.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\ucrtbase.dll (Modified File)
Size 959.72 KB
Hash Values MD5: 7ae17591b38a7b78d3037cf46931a6da
SHA1: c79eabc38a28ab644364602e0d8633971d84f085
SHA256: 873f52e5b57c612cb8502f45911276588a54301dd677880203c2bc9e895d2a6f
Actions
...
c:\program files\common files\microsoft shared\clicktorun\ucrtbase.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\ucrtbase.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\ucrtbase.dll.[evil@cock.lu].evil (Created File)
Size 960.22 KB
Hash Values MD5: 9afd40406e975059c55aab0ceafa3ad0
SHA1: dd2fd549df053994043e4ef99fe537862bcdcc44
SHA256: 902c0889b1673fbf829b393d9dcc60b2822d61cda42f43162019124d02cde14a
Actions
...
c:\program files\common files\microsoft shared\clicktorun\vccorlib140.dll
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\vccorlib140.dll (Modified File)
Size 386.34 KB
Hash Values MD5: 6505bc34cab74af6dcb31c3410a3864d
SHA1: 7e7bbaa978223ac130e1dc9e5006ace5498f40be
SHA256: 3f1c7209c2bbb86ffe4c68059b595ba129f2fe12248e922ddfa57805fa4838f1
Actions
...
c:\program files\common files\microsoft shared\clicktorun\vccorlib140.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\clicktorun\vccorlib140.dll (Modified File)
c:\program files\common files\microsoft shared\clicktorun\vccorlib140.dll.[evil@cock.lu].evil (Created File)
Size 386.84 KB
Hash Values MD5: 33153140aa88e02d2864c44d053b75c5
SHA1: 89fb3a6d23ed018622d365ac2dfb4a2887ac116f
SHA256: e67e03ab038b08947447b3cd76c916abf816ec2d1fe8e7cecda6a87b0462560b
Actions
...
c:\program files\common files\microsoft shared\office16\liclua.exe
»
File Properties
Names c:\program files\common files\microsoft shared\office16\liclua.exe (Modified File)
Size 564.22 KB
Hash Values MD5: 0149d285d003dc5ea714fef12a76c786
SHA1: dedc97c8d3000d5525ab2a9a859742e1fa2d3cb5
SHA256: 0e94faf6a8a5beb0184da45499b42a185dc831971909e829c9c23ac1704b5481
Actions
...
c:\program files\common files\microsoft shared\office16\liclua.exe, ...
»
File Properties
Names c:\program files\common files\microsoft shared\office16\liclua.exe (Modified File)
c:\program files\common files\microsoft shared\office16\liclua.exe.[evil@cock.lu].evil (Created File)
Size 564.72 KB
Hash Values MD5: 6002fdf9063823cfce785e8c3a869e91
SHA1: 80abc8d42db02d4d44a689a8f23ac8383017c41c
SHA256: 7f47df895a4d20337c3f330bb9a5c342ffb8269ba8cbc4230bc1b21125679e35
Actions
...
c:\program files\common files\microsoft shared\office16\office setup controller\pidgenx.dll
»
File Properties
Names c:\program files\common files\microsoft shared\office16\office setup controller\pidgenx.dll (Modified File)
Size 1.41 MB
Hash Values MD5: 524f077d0c14c4d0cfb3a1c1054ef7c0
SHA1: c5b4599e958c8b0499bc57a21c90c3e7d7ad0af3
SHA256: 8d253a19e9c77bc5f77441b841f89243b90b6e550acf2372a538cb22a1cff562
Actions
...
c:\program files\common files\microsoft shared\office16\office setup controller\pidgenx.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\office16\office setup controller\pidgenx.dll (Modified File)
c:\program files\common files\microsoft shared\office16\office setup controller\pidgenx.dll.[evil@cock.lu].evil (Created File)
Size 1.41 MB
Hash Values MD5: 90aee27d63209c968face9f035756947
SHA1: 2f3da20fd7dd06b44e73c651235f2e5b33cdaa07
SHA256: 3e7401f554894f8b78517121d1d7dd661bb699a2a8c7285241ec7241e34d2f6b
Actions
...
c:\program files\common files\microsoft shared\office16\office setup controller\pkeyconfig-office.xrm-ms
»
File Properties
Names c:\program files\common files\microsoft shared\office16\office setup controller\pkeyconfig-office.xrm-ms (Modified File)
Size 624.19 KB
Hash Values MD5: 40237098b6c7a04abcb682ce58513499
SHA1: 3e59f53c8af1d89bb53b7b8c0b6cf19d069ea768
SHA256: 102c94d2c4bc97ee119e2777e560540ca7f9a1d9935ea472c58da3f47a7d2529
Actions
...
c:\program files\common files\microsoft shared\office16\office setup controller\pkeyconfig-office.xrm-ms, ...
»
File Properties
Names c:\program files\common files\microsoft shared\office16\office setup controller\pkeyconfig-office.xrm-ms (Modified File)
c:\program files\common files\microsoft shared\office16\office setup controller\pkeyconfig-office.xrm-ms.[evil@cock.lu].evil (Created File)
Size 624.69 KB
Hash Values MD5: 99abfd2614127fc84af4787ab8034288
SHA1: b42b4c2001fd6aa1b467de62d54dc3ca5301e8ec
SHA256: 0a8329fa58d0945e2ac3737246cb7241cf6855530440d33eb78688b9d175b602
Actions
...
c:\program files\common files\microsoft shared\office16\office setup controller\pkeyconfig.companion.dll
»
File Properties
Names c:\program files\common files\microsoft shared\office16\office setup controller\pkeyconfig.companion.dll (Modified File)
Size 29.22 KB
Hash Values MD5: 7bb1330ce8cba3719f204d41a964063d
SHA1: 78c7b41bdd409a46ab9b379c4e63f7902dee2031
SHA256: 6feb2f019067c173aa349a41593ab476b378788ea8e136a9b879ef8805447681
Actions
...
c:\program files\common files\microsoft shared\office16\office setup controller\pkeyconfig.companion.dll, ...
»
File Properties
Names c:\program files\common files\microsoft shared\office16\office setup controller\pkeyconfig.companion.dll (Modified File)
c:\program files\common files\microsoft shared\office16\office setup controller\pkeyconfig.companion.dll.[evil@cock.lu].evil (Created File)
Size 29.72 KB
Hash Values MD5: 946cbc9c9e949b0a58ae7394bd932360
SHA1: 48620898fde359b15fb2acfbfc781fb4d58a00cb
SHA256: 465d1561461b1a2b469f1623f6f7fb2a55d1f5994078a9512de07a5a7b8af434
Actions
...
c:\program files\common files\microsoft shared\source engine\ose.exe
»
File Properties
Names c:\program files\common files\microsoft shared\source engine\ose.exe (Modified File)
Size 254.22 KB
Hash Values MD5: 0d1c55c99711a47dacecbab07a577330
SHA1: d5ebc2d954e5a2f9ef2e4ba4de8c42632df3d86f
SHA256: 2482f6ed79118c1b911737f069e9b8e4e60877b0a10025c79f10cb5ece91ef2b
Actions
...
c:\program files\common files\microsoft shared\source engine\ose.exe, ...
»
File Properties
Names c:\program files\common files\microsoft shared\source engine\ose.exe (Modified File)
c:\program files\common files\microsoft shared\source engine\ose.exe.[evil@cock.lu].evil (Created File)
Size 254.72 KB
Hash Values MD5: 4e3d9964ceae76205c028a5a71e9b2cd
SHA1: 75dfb4fd21b6ddfcab4a190b6ce77da32e64d77c
SHA256: 6fa23beed14ce49fdcc5acc450e3669218955fea866d5c3cfcbbf57be7a17dd2
Actions
...
c:\program files\common files\microsoft shared\stationery\desktop.ini
»
File Properties
Names c:\program files\common files\microsoft shared\stationery\desktop.ini (Modified File)
Size 0.66 KB
Hash Values MD5: 2a315b0db0af6254647204b062737e72
SHA1: 6e2446c1ad145c01b5e106f86c1f744e09849d35
SHA256: 24cab90290276079bf90a73e5f1f0eb412b9d4a045501bf68e3537cd533bf0ae
Actions
...
c:\program files\common files\microsoft shared\stationery\desktop.ini, ...
»
File Properties
Names c:\program files\common files\microsoft shared\stationery\desktop.ini (Modified File)
c:\program files\common files\microsoft shared\stationery\desktop.ini.[evil@cock.lu].evil (Created File)
Size 1.16 KB
Hash Values MD5: 74b83dc533dfa21bef2300274dedae0a
SHA1: 9275fa2439ec1050615e0bbbcb8cba3cf8dcc924
SHA256: 5bafc129a05f278a4a3f319abacc47db83ec23fb33dfd8aa49709e0ec52f45f0
Actions
...
c:\program files\common files\microsoft shared\vc\msdia100.dll
»
File Properties
Names c:\program files\common files\microsoft shared\vc\msdia100.dll (Modified File)
Size 498.87 KB
Hash Values MD5: 098a92e7933ce089ec4e9a03ae19890a
SHA1: 846bf52ab66806e5f63076a29629509fbd72ce60
SHA256: 9a01a1775ecd75426aae9f663f8183dba0786bac20de7ce8c3df5a0fcd35e889
Actions
...
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image