Analysis
-
max time kernel
250s -
max time network
228s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15-09-2024 22:10
Static task
static1
Behavioral task
behavioral1
Sample
RNSM00482.7z
Resource
win10v2004-20240802-en
General
-
Target
RNSM00482.7z
-
Size
27.9MB
-
MD5
9bf6d6ed36fbce36dfa9c23d594d677b
-
SHA1
c922fcf9bc1dcbf8bbd992acd4834a8110e40477
-
SHA256
2f4c48af21206e7be9d0a59ebd7ced2b5f2638dad52f76389adb5317fddf9a2e
-
SHA512
ed422d7e350246861d7ff2d56cd86f925233a5682686517f73e645cccc4ea2dd146a78811dc9389872ec0bd8c7bc2327a8f37fed905f0b8c48c4b5655076f9b7
-
SSDEEP
786432:uD9Xo4F/hdhUY+mF9nb5QTqEtTH+3+U5Pe2n1GlBINEyFnx:qYu5dO3yJ5QTtTHq+2f9dx
Malware Config
Extracted
djvu
http://securebiz.org/fhsgtsspen6/get.php
-
extension
.tisc
-
offline_id
uFHwN7bjwCkJEeUg8JHISzLqrwudidH8XsPzHDt1
-
payload_url
http://znpst.top/dl/build2.exe
http://securebiz.org/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-1JwFK5rT39 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0336gSd743d
Extracted
C:\Users\GET_YOUR_FILES_BACK.txt
avoslocker
http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion
http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion
Extracted
tofsee
43.231.4.7
lazystax.ru
Extracted
C:\Read Me.TXT
Extracted
F:\Program Files\FoxitReader\bin\!! READ ME !!.txt
http://cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion/
Extracted
urelas
1.234.83.146
133.242.129.155
218.54.31.226
218.54.30.235
218.54.31.165
Signatures
-
Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 2 IoCs
resource yara_rule behavioral1/files/0x0007000000023478-137.dat family_chaos behavioral1/memory/4120-139-0x00000000005A0000-0x00000000005EE000-memory.dmp family_chaos -
Detect MafiaWare666 ransomware 2 IoCs
resource yara_rule behavioral1/files/0x000700000002347a-145.dat family_mafiaware666 behavioral1/memory/2380-155-0x00000000003C0000-0x000000000042A000-memory.dmp family_mafiaware666 -
Detected Djvu ransomware 8 IoCs
resource yara_rule behavioral1/memory/508-579-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/508-583-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/508-787-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/508-1065-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/6044-1188-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/6044-1186-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/6044-1218-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/6044-1217-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
GandCrab payload 3 IoCs
resource yara_rule behavioral1/memory/3120-495-0x0000000000CC0000-0x0000000000CD7000-memory.dmp family_gandcrab behavioral1/memory/3120-494-0x0000000000400000-0x0000000000B4B000-memory.dmp family_gandcrab behavioral1/memory/3120-521-0x0000000000400000-0x0000000000B4B000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty" HEUR-Trojan-Ransom.MSIL.Encoder.gen-1d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26.exe -
Clears Windows event logs 1 TTPs 4 IoCs
pid Process 2136 wevtutil.exe 1964 wevtutil.exe 5384 wevtutil.exe 6012 wevtutil.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 5704 powershell.exe 5552 powershell.exe -
Creates new service(s) 2 TTPs
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 3764 netsh.exe 4880 netsh.exe 3528 netsh.exe -
resource yara_rule behavioral1/files/0x0007000000023488-537.dat aspack_v212_v242 behavioral1/files/0x00070000000234b8-613.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation HEUR-Trojan-Ransom.Win32.Blocker.pef-f274951a2e7bc1d5c4e2c5ffd8bb93efd1ca9abc7aa1fc32f0196eec424a4f39.exe -
Executes dropped EXE 15 IoCs
pid Process 4120 HEUR-Trojan-Ransom.MSIL.Agent.gen-d2080b0b0f087ebe9c16d91a25ceb1d5d4c32bed258f4dcb91c3b83bb0070db7.exe 2864 HEUR-Trojan-Ransom.MSIL.Blocker.gen-174baeb61d7db21bc0034a6add46e2c8b1579b9e0be8bedea96f612debd7b14d.exe 2380 HEUR-Trojan-Ransom.MSIL.Crypren.gen-0c60599f5e5c8172c4b7a551f3ba4b43aeec5fea6976bf8fd2b38e5fb1ee8f13.exe 2340 HEUR-Trojan-Ransom.MSIL.Encoder.gen-1d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26.exe 248 HEUR-Trojan-Ransom.MSIL.Purgen.gen-77181bf77dde9838240d6ae57aaf37d2e96cc089a5bdd8c530a9b5195c290851.exe 760 HEUR-Trojan-Ransom.Win32.Blocker.gen-6c2fd975d70bfebbac1ca3661f8abd7308b8542a036dd8abfd223b1b78d58847.exe 2148 HEUR-Trojan-Ransom.Win32.Blocker.pef-f274951a2e7bc1d5c4e2c5ffd8bb93efd1ca9abc7aa1fc32f0196eec424a4f39.exe 3512 HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe 4044 zbhnd.exe 4884 HEUR-Trojan-Ransom.Win32.Cryptoff.vho-fd9867c02033d592fbaa4cce9eee14d7d1b6bb90beb5fb5b12379946311a37fd.exe 1416 HEUR-Trojan-Ransom.Win32.Cryptor.gen-1b53c48f6dbe0eba14631c633e941417014125aa731b5e2f4caa444e1099d13a.exe 2884 HEUR-Trojan-Ransom.Win32.Cuba.gen-adb12f4ed01d1f59ffc45186fc85d502ddeebfd26438aa2c7e4383566fb9739f.exe 3120 HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe 2748 HEUR-Trojan-Ransom.Win32.Gen.gen-cbcc839cbe4c2c684dfe9fcfb16ed261d9b6b2a73a404a45fe740c0f46bbcc23.exe 3540 HEUR-Trojan-Ransom.Win32.Generic-2ca977fd3323e3e4997747476965c2251feccc466809e3594ec1fec47754aa2f.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 5200 icacls.exe -
resource yara_rule behavioral1/memory/3512-170-0x0000000000400000-0x00000000005BB000-memory.dmp upx behavioral1/files/0x000700000002347f-169.dat upx behavioral1/files/0x0003000000000739-189.dat upx behavioral1/memory/3512-570-0x0000000000400000-0x00000000005BB000-memory.dmp upx behavioral1/memory/492-763-0x0000000000E80000-0x0000000000F7A000-memory.dmp upx behavioral1/memory/1964-788-0x0000000000E80000-0x0000000000F7A000-memory.dmp upx behavioral1/files/0x0007000000023540-847.dat upx behavioral1/memory/5672-870-0x0000000000400000-0x00000000004AA000-memory.dmp upx behavioral1/memory/1964-924-0x0000000000E80000-0x0000000000F7A000-memory.dmp upx behavioral1/memory/664-925-0x0000000000CF0000-0x0000000000DEA000-memory.dmp upx behavioral1/memory/3624-953-0x0000000000CF0000-0x0000000000DEA000-memory.dmp upx behavioral1/memory/492-952-0x0000000000E80000-0x0000000000F7A000-memory.dmp upx behavioral1/files/0x00070000000235b7-1037.dat upx behavioral1/memory/5672-1205-0x0000000000400000-0x00000000004AA000-memory.dmp upx behavioral1/memory/664-2297-0x0000000000CF0000-0x0000000000DEA000-memory.dmp upx behavioral1/memory/3624-2294-0x0000000000CF0000-0x0000000000DEA000-memory.dmp upx behavioral1/memory/8376-10694-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/8376-18115-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/7288-26474-0x0000000000400000-0x000000000048B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xwagv2aq4y = "C:\\Users\\Admin\\Desktop\\00482\\HEUR-Trojan-Ransom.Win32.Cryptoff.vho-fd9867c02033d592fbaa4cce9eee14d7d1b6bb90beb5fb5b12379946311a37fd.exe" HEUR-Trojan-Ransom.Win32.Cryptoff.vho-fd9867c02033d592fbaa4cce9eee14d7d1b6bb90beb5fb5b12379946311a37fd.exe -
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 64 api.2ip.ua 86 api.2ip.ua 87 api.2ip.ua 126 api.my-ip.io 127 api.my-ip.io 63 api.2ip.ua -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/492-763-0x0000000000E80000-0x0000000000F7A000-memory.dmp autoit_exe behavioral1/memory/1964-788-0x0000000000E80000-0x0000000000F7A000-memory.dmp autoit_exe behavioral1/memory/1964-924-0x0000000000E80000-0x0000000000F7A000-memory.dmp autoit_exe behavioral1/memory/664-925-0x0000000000CF0000-0x0000000000DEA000-memory.dmp autoit_exe behavioral1/memory/3624-953-0x0000000000CF0000-0x0000000000DEA000-memory.dmp autoit_exe behavioral1/memory/492-952-0x0000000000E80000-0x0000000000F7A000-memory.dmp autoit_exe behavioral1/memory/664-2297-0x0000000000CF0000-0x0000000000DEA000-memory.dmp autoit_exe behavioral1/memory/3624-2294-0x0000000000CF0000-0x0000000000DEA000-memory.dmp autoit_exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\Wallpaper HEUR-Trojan-Ransom.MSIL.Encoder.gen-1d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26.exe -
Drops file in Program Files directory 16 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zFM.exe HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe File created C:\Program Files\7-Zip\7-zip.chm.exe HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe File created C:\Program Files\7-Zip\7-zip.dll.exe HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe File created C:\Program Files\7-Zip\7-zip32.dll.exe HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe File opened for modification C:\Program Files\7-Zip\7z.exe HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe File opened for modification C:\Program Files\7-Zip\7z.sfx HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe File created C:\Program Files\7-Zip\7z.sfx.exe HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe File created C:\Program Files\7-Zip\7-zip.dll HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe File opened for modification C:\Program Files\7-Zip\7z.dll HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe File created C:\Program Files\7-Zip\7zFM.exe.exe HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe File created C:\Program Files\7-Zip\7z.dll.exe HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe File created C:\Program Files\7-Zip\7zCon.sfx.exe HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe File created C:\Program Files\7-Zip\7z.exe.exe HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5664 sc.exe 2000 sc.exe 6140 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 7 IoCs
pid pid_target Process procid_target 2420 248 WerFault.exe 106 5364 3120 WerFault.exe 122 4172 6040 WerFault.exe 145 5924 248 WerFault.exe 194 3352 3404 WerFault.exe 187 11116 5068 WerFault.exe 282 12028 392 WerFault.exe 283 -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Ransom.Win32.Cryptor.gen-1b53c48f6dbe0eba14631c633e941417014125aa731b5e2f4caa444e1099d13a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Ransom.MSIL.Crypren.gen-0c60599f5e5c8172c4b7a551f3ba4b43aeec5fea6976bf8fd2b38e5fb1ee8f13.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Ransom.Win32.Blocker.pef-f274951a2e7bc1d5c4e2c5ffd8bb93efd1ca9abc7aa1fc32f0196eec424a4f39.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zbhnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Ransom.Win32.Cuba.gen-adb12f4ed01d1f59ffc45186fc85d502ddeebfd26438aa2c7e4383566fb9739f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Ransom.Win32.Gen.gen-cbcc839cbe4c2c684dfe9fcfb16ed261d9b6b2a73a404a45fe740c0f46bbcc23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Ransom.MSIL.Purgen.gen-77181bf77dde9838240d6ae57aaf37d2e96cc089a5bdd8c530a9b5195c290851.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Ransom.Win32.Blocker.gen-6c2fd975d70bfebbac1ca3661f8abd7308b8542a036dd8abfd223b1b78d58847.exe -
Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2136 ipconfig.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings OpenWith.exe -
Runs net.exe
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3760 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1096 powershell.exe 1096 powershell.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4932 7zFM.exe 4364 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeRestorePrivilege 4932 7zFM.exe Token: 35 4932 7zFM.exe Token: SeSecurityPrivilege 4932 7zFM.exe Token: SeDebugPrivilege 1096 powershell.exe Token: SeDebugPrivilege 4860 taskmgr.exe Token: SeSystemProfilePrivilege 4860 taskmgr.exe Token: SeCreateGlobalPrivilege 4860 taskmgr.exe Token: SeDebugPrivilege 4364 taskmgr.exe Token: SeSystemProfilePrivilege 4364 taskmgr.exe Token: SeCreateGlobalPrivilege 4364 taskmgr.exe Token: 33 4860 taskmgr.exe Token: SeIncBasePriorityPrivilege 4860 taskmgr.exe Token: SeDebugPrivilege 4120 HEUR-Trojan-Ransom.MSIL.Agent.gen-d2080b0b0f087ebe9c16d91a25ceb1d5d4c32bed258f4dcb91c3b83bb0070db7.exe Token: SeDebugPrivilege 248 HEUR-Trojan-Ransom.MSIL.Purgen.gen-77181bf77dde9838240d6ae57aaf37d2e96cc089a5bdd8c530a9b5195c290851.exe Token: SeDebugPrivilege 2340 HEUR-Trojan-Ransom.MSIL.Encoder.gen-1d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26.exe Token: SeLoadDriverPrivilege 3120 HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Token: SeLoadDriverPrivilege 3120 HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe Token: SeLoadDriverPrivilege 3120 HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4932 7zFM.exe 4932 7zFM.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4860 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe 4364 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3004 OpenWith.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1096 wrote to memory of 3332 1096 powershell.exe 98 PID 1096 wrote to memory of 3332 1096 powershell.exe 98 PID 4860 wrote to memory of 4364 4860 taskmgr.exe 100 PID 4860 wrote to memory of 4364 4860 taskmgr.exe 100 PID 3332 wrote to memory of 4120 3332 cmd.exe 101 PID 3332 wrote to memory of 4120 3332 cmd.exe 101 PID 3332 wrote to memory of 2864 3332 cmd.exe 102 PID 3332 wrote to memory of 2864 3332 cmd.exe 102 PID 3332 wrote to memory of 2380 3332 cmd.exe 103 PID 3332 wrote to memory of 2380 3332 cmd.exe 103 PID 3332 wrote to memory of 2380 3332 cmd.exe 103 PID 3332 wrote to memory of 2340 3332 cmd.exe 104 PID 3332 wrote to memory of 2340 3332 cmd.exe 104 PID 3332 wrote to memory of 248 3332 cmd.exe 106 PID 3332 wrote to memory of 248 3332 cmd.exe 106 PID 3332 wrote to memory of 248 3332 cmd.exe 106 PID 3332 wrote to memory of 760 3332 cmd.exe 107 PID 3332 wrote to memory of 760 3332 cmd.exe 107 PID 3332 wrote to memory of 760 3332 cmd.exe 107 PID 3332 wrote to memory of 2148 3332 cmd.exe 109 PID 3332 wrote to memory of 2148 3332 cmd.exe 109 PID 3332 wrote to memory of 2148 3332 cmd.exe 109 PID 3332 wrote to memory of 3512 3332 cmd.exe 110 PID 3332 wrote to memory of 3512 3332 cmd.exe 110 PID 2148 wrote to memory of 4044 2148 HEUR-Trojan-Ransom.Win32.Blocker.pef-f274951a2e7bc1d5c4e2c5ffd8bb93efd1ca9abc7aa1fc32f0196eec424a4f39.exe 114 PID 2148 wrote to memory of 4044 2148 HEUR-Trojan-Ransom.Win32.Blocker.pef-f274951a2e7bc1d5c4e2c5ffd8bb93efd1ca9abc7aa1fc32f0196eec424a4f39.exe 114 PID 2148 wrote to memory of 4044 2148 HEUR-Trojan-Ransom.Win32.Blocker.pef-f274951a2e7bc1d5c4e2c5ffd8bb93efd1ca9abc7aa1fc32f0196eec424a4f39.exe 114 PID 3332 wrote to memory of 4884 3332 cmd.exe 116 PID 3332 wrote to memory of 4884 3332 cmd.exe 116 PID 3332 wrote to memory of 1416 3332 cmd.exe 118 PID 3332 wrote to memory of 1416 3332 cmd.exe 118 PID 3332 wrote to memory of 1416 3332 cmd.exe 118 PID 3332 wrote to memory of 2884 3332 cmd.exe 121 PID 3332 wrote to memory of 2884 3332 cmd.exe 121 PID 3332 wrote to memory of 2884 3332 cmd.exe 121 PID 3332 wrote to memory of 3120 3332 cmd.exe 122 PID 3332 wrote to memory of 3120 3332 cmd.exe 122 PID 3332 wrote to memory of 3120 3332 cmd.exe 122 PID 3332 wrote to memory of 2748 3332 cmd.exe 123 PID 3332 wrote to memory of 2748 3332 cmd.exe 123 PID 3332 wrote to memory of 2748 3332 cmd.exe 123 PID 3332 wrote to memory of 3540 3332 cmd.exe 124 PID 3332 wrote to memory of 3540 3332 cmd.exe 124 PID 3332 wrote to memory of 3540 3332 cmd.exe 124
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\RNSM00482.7z1⤵
- Modifies registry class
PID:4508
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3004
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1232
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00482.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4932
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Agent.gen-d2080b0b0f087ebe9c16d91a25ceb1d5d4c32bed258f4dcb91c3b83bb0070db7.exeHEUR-Trojan-Ransom.MSIL.Agent.gen-d2080b0b0f087ebe9c16d91a25ceb1d5d4c32bed258f4dcb91c3b83bb0070db7.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Blocker.gen-174baeb61d7db21bc0034a6add46e2c8b1579b9e0be8bedea96f612debd7b14d.exeHEUR-Trojan-Ransom.MSIL.Blocker.gen-174baeb61d7db21bc0034a6add46e2c8b1579b9e0be8bedea96f612debd7b14d.exe3⤵
- Executes dropped EXE
PID:2864 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" #/k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\system32\Microsoft\Airexpress & exit4⤵PID:4960
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\system32\Microsoft\Airexpress5⤵
- Command and Scripting Interpreter: PowerShell
PID:5704
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" #/k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\system32\Holocryptic\Crossbarre.exe & exit4⤵PID:4188
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\system32\Holocryptic\Crossbarre.exe5⤵
- Command and Scripting Interpreter: PowerShell
PID:5552
-
-
-
C:\Windows\System32\ipconfig.exe"C:\Windows\System32\ipconfig.exe" flushdns4⤵
- Gathers network information
PID:2136
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /delete /tn Service /f4⤵PID:3548
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /sc minute /mo 10 /tn Service /tr "C:\Windows\system32\Holocryptic\Crossbarre.exe"4⤵
- Scheduled Task/Job: Scheduled Task
PID:3760
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe/Processid:{0a52d887-c53b-4a50-a125-d38c5aaa675f}4⤵PID:7592
-
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Crypren.gen-0c60599f5e5c8172c4b7a551f3ba4b43aeec5fea6976bf8fd2b38e5fb1ee8f13.exeHEUR-Trojan-Ransom.MSIL.Crypren.gen-0c60599f5e5c8172c4b7a551f3ba4b43aeec5fea6976bf8fd2b38e5fb1ee8f13.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2380
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Encoder.gen-1d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26.exeHEUR-Trojan-Ransom.MSIL.Encoder.gen-1d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26.exe3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Purgen.gen-77181bf77dde9838240d6ae57aaf37d2e96cc089a5bdd8c530a9b5195c290851.exeHEUR-Trojan-Ransom.MSIL.Purgen.gen-77181bf77dde9838240d6ae57aaf37d2e96cc089a5bdd8c530a9b5195c290851.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:248 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 248 -s 16084⤵
- Program crash
PID:2420
-
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Blocker.gen-6c2fd975d70bfebbac1ca3661f8abd7308b8542a036dd8abfd223b1b78d58847.exeHEUR-Trojan-Ransom.Win32.Blocker.gen-6c2fd975d70bfebbac1ca3661f8abd7308b8542a036dd8abfd223b1b78d58847.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:760 -
C:\Users\Admin\1740948824551711\wcfgmgr32.exe"C:\Users\Admin\1740948824551711\wcfgmgr32.exe"4⤵PID:5212
-
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Blocker.pef-f274951a2e7bc1d5c4e2c5ffd8bb93efd1ca9abc7aa1fc32f0196eec424a4f39.exeHEUR-Trojan-Ransom.Win32.Blocker.pef-f274951a2e7bc1d5c4e2c5ffd8bb93efd1ca9abc7aa1fc32f0196eec424a4f39.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4044
-
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exeHEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3512
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Cryptoff.vho-fd9867c02033d592fbaa4cce9eee14d7d1b6bb90beb5fb5b12379946311a37fd.exeHEUR-Trojan-Ransom.Win32.Cryptoff.vho-fd9867c02033d592fbaa4cce9eee14d7d1b6bb90beb5fb5b12379946311a37fd.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4884
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Cryptor.gen-1b53c48f6dbe0eba14631c633e941417014125aa731b5e2f4caa444e1099d13a.exeHEUR-Trojan-Ransom.Win32.Cryptor.gen-1b53c48f6dbe0eba14631c633e941417014125aa731b5e2f4caa444e1099d13a.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1416
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Cuba.gen-adb12f4ed01d1f59ffc45186fc85d502ddeebfd26438aa2c7e4383566fb9739f.exeHEUR-Trojan-Ransom.Win32.Cuba.gen-adb12f4ed01d1f59ffc45186fc85d502ddeebfd26438aa2c7e4383566fb9739f.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2884
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exeHEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3120 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 4884⤵
- Program crash
PID:5364
-
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Gen.gen-cbcc839cbe4c2c684dfe9fcfb16ed261d9b6b2a73a404a45fe740c0f46bbcc23.exeHEUR-Trojan-Ransom.Win32.Gen.gen-cbcc839cbe4c2c684dfe9fcfb16ed261d9b6b2a73a404a45fe740c0f46bbcc23.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2748
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Generic-2ca977fd3323e3e4997747476965c2251feccc466809e3594ec1fec47754aa2f.exeHEUR-Trojan-Ransom.Win32.Generic-2ca977fd3323e3e4997747476965c2251feccc466809e3594ec1fec47754aa2f.exe3⤵
- Executes dropped EXE
PID:3540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSDTC4⤵PID:4504
-
C:\Windows\SysWOW64\net.exenet stop MSDTC5⤵PID:5392
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSDTC6⤵PID:5472
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵PID:5964
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no4⤵PID:6140
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet4⤵PID:2240
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT4⤵PID:5064
-
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT5⤵PID:5244
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT6⤵PID:1908
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER4⤵PID:3348
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER5⤵PID:6016
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER6⤵PID:5984
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop vds4⤵PID:5072
-
C:\Windows\SysWOW64\net.exenet stop vds5⤵PID:2720
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vds6⤵PID:5128
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off4⤵PID:3956
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set currentprofile state off5⤵
- Modifies Windows Firewall
PID:4880
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable4⤵PID:5724
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable5⤵
- Modifies Windows Firewall
PID:3528
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLWriter4⤵PID:4264
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLBrowser4⤵PID:7412
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER4⤵PID:1744
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER5⤵PID:8200
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER6⤵PID:7904
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO14⤵PID:2600
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$CONTOSO15⤵PID:9468
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$CONTOSO16⤵PID:10276
-
-
-
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Generic-70aa68770bdd23400254e08045cba305b674d5c98bd5f9910b9672c76fe5bb0d.exeHEUR-Trojan-Ransom.Win32.Generic-70aa68770bdd23400254e08045cba305b674d5c98bd5f9910b9672c76fe5bb0d.exe3⤵PID:2448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /All /Quiet4⤵PID:6024
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil clear-log Application4⤵PID:1052
-
C:\Windows\SysWOW64\wevtutil.exewevtutil clear-log Application5⤵
- Clears Windows event logs
PID:1964
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil clear-log Security4⤵PID:1960
-
C:\Windows\SysWOW64\wevtutil.exewevtutil clear-log Security5⤵
- Clears Windows event logs
PID:5384
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil clear-log Setup4⤵PID:5900
-
C:\Windows\SysWOW64\wevtutil.exewevtutil clear-log Setup5⤵
- Clears Windows event logs
PID:6012
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil clear-log System4⤵PID:3376
-
C:\Windows\SysWOW64\wevtutil.exewevtutil clear-log System5⤵
- Clears Windows event logs
PID:2136
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet4⤵PID:1336
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wbadmin delete systemstatebackup -deleteoldest -quiet4⤵PID:6028
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ftype redeemer="C:\Windows\system32\cmd.exe" /c msg * Redeemer Ransowmare - this file cannot be opened until decrypted. Check ReadMe.TXT for more details how to decrypt your file.4⤵PID:5916
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c assoc .redeem=redeemer4⤵PID:4668
-
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Generic-cbe63721845f03919c2aa83a4a77280b14932c16fb68e3a46e8c367e24a27909.exeHEUR-Trojan-Ransom.Win32.Generic-cbe63721845f03919c2aa83a4a77280b14932c16fb68e3a46e8c367e24a27909.exe3⤵PID:5416
-
C:\Users\Admin\AppData\Roaming\pendrive.exe"C:\Users\Admin\AppData\Roaming\pendrive.exe" C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Generic-cbe63721845f03919c2aa83a4a77280b14932c16fb68e3a46e8c367e24a27909.exe4⤵PID:5520
-
C:\Users\Admin\AppData\Roaming\Windows Objects\wmiintegrator.exe"C:\Users\Admin\AppData\Roaming\Windows Objects\wmiintegrator.exe" unk5⤵PID:5576
-
C:\Users\Admin\AppData\Roaming\Windows Objects\wmihostwin.exe"C:\Users\Admin\AppData\Roaming\Windows Objects\wmihostwin.exe" unk26⤵PID:5652
-
C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe" unk37⤵PID:5712
-
C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure.exe"C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure.exe" execute8⤵PID:5780
-
-
C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure64.exe"C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure64.exe" autorun8⤵PID:5816
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵PID:3088
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵PID:5392
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵PID:5228
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵PID:5584
-
-
-
-
-
-
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-6f9999a53022f6d22beabb39406e849e3cbbd76e645f2148386ed89fbb94a133.exeHEUR-Trojan-Ransom.Win32.PolyRansom.gen-6f9999a53022f6d22beabb39406e849e3cbbd76e645f2148386ed89fbb94a133.exe3⤵PID:5772
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-144c5a85c642ef1376771a548acd625f4b980415c55d3acd098964ac7f8d5322.exeHEUR-Trojan-Ransom.Win32.Stop.gen-144c5a85c642ef1376771a548acd625f4b980415c55d3acd098964ac7f8d5322.exe3⤵PID:6040
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\cmcfetgx\4⤵PID:5376
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\neahyxbf.exe" C:\Windows\SysWOW64\cmcfetgx\4⤵PID:5600
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create cmcfetgx binPath= "C:\Windows\SysWOW64\cmcfetgx\neahyxbf.exe /d\"C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-144c5a85c642ef1376771a548acd625f4b980415c55d3acd098964ac7f8d5322.exe\"" type= own start= auto DisplayName= "wifi support"4⤵
- Launches sc.exe
PID:5664
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description cmcfetgx "wifi internet conection"4⤵
- Launches sc.exe
PID:2000
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start cmcfetgx4⤵
- Launches sc.exe
PID:6140
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul4⤵
- Modifies Windows Firewall
PID:3764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 11044⤵
- Program crash
PID:4172
-
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exeHEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exe3⤵PID:2356
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exeHEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exe4⤵PID:508
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\4b6bcf10-cffe-4641-9f08-9d974bf57469" /deny *S-1-1-0:(OI)(CI)(DE,DC)5⤵
- Modifies file permissions
PID:5200
-
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exe"C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exe" --Admin IsNotAutoStart IsNotTask5⤵PID:844
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exe"C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exe" --Admin IsNotAutoStart IsNotTask6⤵PID:6044
-
-
-
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Agent.iza-3ff29804ebf38bb4dd80985971848dae2136e55bd60dca68984ebbe9b670a719.exeTrojan-Ransom.Win32.Agent.iza-3ff29804ebf38bb4dd80985971848dae2136e55bd60dca68984ebbe9b670a719.exe3⤵PID:492
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Agent.iza-3ff29804ebf38bb4dd80985971848dae2136e55bd60dca68984ebbe9b670a719.exeC:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Agent.iza-3ff29804ebf38bb4dd80985971848dae2136e55bd60dca68984ebbe9b670a719.exe /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\delph1.dat"4⤵PID:1964
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C echo. > "C:\Users\Admin\AppData\Roaming\Isass.exe":Zone.Identifier5⤵PID:5660
-
-
C:\Users\Admin\AppData\Roaming\Isass.exeC:\Users\Admin\AppData\Roaming\Isass.exe5⤵PID:664
-
C:\Users\Admin\AppData\Roaming\Isass.exeC:\Users\Admin\AppData\Roaming\Isass.exe /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\delph1.dat"6⤵PID:3624
-
-
-
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Bitman.qkb-dbee083dc340bc7c92ab2f4ce3fb988400cbe4f50c5e4c429ed4b0c53b62bd2c.exeTrojan-Ransom.Win32.Bitman.qkb-dbee083dc340bc7c92ab2f4ce3fb988400cbe4f50c5e4c429ed4b0c53b62bd2c.exe3⤵PID:248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 248 -s 1604⤵
- Program crash
PID:5924
-
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Bitman.wsc-6aba0494180fbde7a85fa184c1fa767df1bfd4bca92101b737ee9774226bda81.exeTrojan-Ransom.Win32.Bitman.wsc-6aba0494180fbde7a85fa184c1fa767df1bfd4bca92101b737ee9774226bda81.exe3⤵PID:3008
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Bitman.wsc-6aba0494180fbde7a85fa184c1fa767df1bfd4bca92101b737ee9774226bda81.exeTrojan-Ransom.Win32.Bitman.wsc-6aba0494180fbde7a85fa184c1fa767df1bfd4bca92101b737ee9774226bda81.exe4⤵PID:11136
-
C:\Users\Admin\AppData\Roaming\wlrmdr.exeC:\Users\Admin\AppData\Roaming\wlrmdr.exe5⤵PID:9944
-
-
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Blocker.iyjg-a96b98a3c0278ce4bbf7f3c526110e1b4bbf9ee3f0fec882f67b0c3c5c8bf0ba.exeTrojan-Ransom.Win32.Blocker.iyjg-a96b98a3c0278ce4bbf7f3c526110e1b4bbf9ee3f0fec882f67b0c3c5c8bf0ba.exe3⤵PID:5672
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Blocker.jgb-9778caaff1491f25f0a7ba31889bdecacb71ddf7a0d169f44500c35d8c6782bf.exeTrojan-Ransom.Win32.Blocker.jgb-9778caaff1491f25f0a7ba31889bdecacb71ddf7a0d169f44500c35d8c6782bf.exe3⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe\\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe4⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE\\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE5⤵PID:10928
-
-
-
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE\\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE4⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe\\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe5⤵PID:10920
-
-
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Blocker.mgn-ecf5d43183730ceed0db34e357103937a4e6fbb09eb0a2359cb320a899a32231.exeTrojan-Ransom.Win32.Blocker.mgn-ecf5d43183730ceed0db34e357103937a4e6fbb09eb0a2359cb320a899a32231.exe3⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe\\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe4⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE\\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE5⤵PID:11224
-
-
-
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE\\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE4⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe\\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe5⤵PID:7492
-
-
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Blocker.ncko-f338884752cdfa1356b7edaef0d2bccaa2df7feba0a3d7576cb714e16e8447c6.exeTrojan-Ransom.Win32.Blocker.ncko-f338884752cdfa1356b7edaef0d2bccaa2df7feba0a3d7576cb714e16e8447c6.exe3⤵PID:5308
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Blocker.ncle-872f15d2c2621269b2574d82afa8b8d2fe15471dfb7a7b9631f1207a631472a2.exeTrojan-Ransom.Win32.Blocker.ncle-872f15d2c2621269b2574d82afa8b8d2fe15471dfb7a7b9631f1207a631472a2.exe3⤵PID:4652
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Blocker.nfok-de78b27e6358929f894bd79354168a2c17d259fd730a3df40f118c9735808303.exeTrojan-Ransom.Win32.Blocker.nfok-de78b27e6358929f894bd79354168a2c17d259fd730a3df40f118c9735808303.exe3⤵PID:5996
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Blocker.ngna-3666316716fdd6f6dcffd23dc1b30c9f2b664336698e248ed52d0b6d499106bb.exeTrojan-Ransom.Win32.Blocker.ngna-3666316716fdd6f6dcffd23dc1b30c9f2b664336698e248ed52d0b6d499106bb.exe3⤵PID:3972
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Cryptodef.aoo-0f44655bda32c5bac1d24c46ae08999072a6aa140470129d13a8bf0686b66f2c.exeTrojan-Ransom.Win32.Cryptodef.aoo-0f44655bda32c5bac1d24c46ae08999072a6aa140470129d13a8bf0686b66f2c.exe3⤵PID:7292
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Cryptodef.aoo-62573c8d9dcfe5b7ba9fd8f98d5e905c8c8db6deda9cf02ae5be7c31479b67de.exeTrojan-Ransom.Win32.Cryptodef.aoo-62573c8d9dcfe5b7ba9fd8f98d5e905c8c8db6deda9cf02ae5be7c31479b67de.exe3⤵PID:11116
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Cryptodef.jj-03467f231a3fce6795545ae99a6dad161effa3bf681031693815eabf1648ee66.exeTrojan-Ransom.Win32.Cryptodef.jj-03467f231a3fce6795545ae99a6dad161effa3bf681031693815eabf1648ee66.exe3⤵PID:4892
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"4⤵PID:7148
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs5⤵PID:6792
-
-
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Foreign.njky-f0cd3107d3367d431383ce6144e8ffa0e56a6676ba599749b1b127983e767d8f.exeTrojan-Ransom.Win32.Foreign.njky-f0cd3107d3367d431383ce6144e8ffa0e56a6676ba599749b1b127983e767d8f.exe3⤵PID:10208
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.GandCrypt.ate-f5a806f8dfe1ce6f8e54ef7668b94f78b937a4032650ecd35e18c55327068de3.exeTrojan-Ransom.Win32.GandCrypt.ate-f5a806f8dfe1ce6f8e54ef7668b94f78b937a4032650ecd35e18c55327068de3.exe3⤵PID:9964
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.GandCrypt.oc-1879d405bad6a51ac71b990ed44071cc8f2874d8087993e7e36b51528de24450.exeTrojan-Ransom.Win32.GandCrypt.oc-1879d405bad6a51ac71b990ed44071cc8f2874d8087993e7e36b51528de24450.exe3⤵PID:7408
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.GenericCryptor.cys-a725a15d226ef451b36f7baf5ca9cc6e02813e21d267c9f64b371939a4b06a06.exeTrojan-Ransom.Win32.GenericCryptor.cys-a725a15d226ef451b36f7baf5ca9cc6e02813e21d267c9f64b371939a4b06a06.exe3⤵PID:8376
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.GenericCryptor.czx-cdbc98fc99f27af6a7a4e20709a2262b2273681084ea5858695eedbd879e092b.exeTrojan-Ransom.Win32.GenericCryptor.czx-cdbc98fc99f27af6a7a4e20709a2262b2273681084ea5858695eedbd879e092b.exe3⤵PID:7288
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Gimemo.cdqu-ab1e181416fb4a785c412daac4198eb834502d9cdc994d05da63b00ab0ec6f50.exeTrojan-Ransom.Win32.Gimemo.cdqu-ab1e181416fb4a785c412daac4198eb834502d9cdc994d05da63b00ab0ec6f50.exe3⤵PID:8592
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Locky.acy-c5b788d44ebbc95ef2eb6e84d789b8fe8fedff652c5712de6cd5ba6ae62ea221.exeTrojan-Ransom.Win32.Locky.acy-c5b788d44ebbc95ef2eb6e84d789b8fe8fedff652c5712de6cd5ba6ae62ea221.exe3⤵PID:5068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 2324⤵
- Program crash
PID:11116
-
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Petr.aqv-4f585b2134ef49fce0236ae648cfff81008dbc7a677a128a7ed7072a01c17f76.exeTrojan-Ransom.Win32.Petr.aqv-4f585b2134ef49fce0236ae648cfff81008dbc7a677a128a7ed7072a01c17f76.exe3⤵PID:392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 11724⤵
- Program crash
PID:12028
-
-
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.PornoBlocker.ajrm-76ce5940714505149d61567b94e169b9781cfefd8da6630ae153fac04fd28f98.exeTrojan-Ransom.Win32.PornoBlocker.ajrm-76ce5940714505149d61567b94e169b9781cfefd8da6630ae153fac04fd28f98.exe3⤵PID:11152
-
-
C:\Users\Admin\Desktop\00482\UDS-Trojan-Ransom.Win32.Blocker-3b3a46c7dd0f8e109355ac57dc1e38fcad19b197bb7e86e2e302df724227208c.exeUDS-Trojan-Ransom.Win32.Blocker-3b3a46c7dd0f8e109355ac57dc1e38fcad19b197bb7e86e2e302df724227208c.exe3⤵PID:9972
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /12⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 248 -ip 2481⤵PID:2588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3120 -ip 31201⤵PID:5328
-
C:\Windows\SysWOW64\cmcfetgx\neahyxbf.exeC:\Windows\SysWOW64\cmcfetgx\neahyxbf.exe /d"C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-144c5a85c642ef1376771a548acd625f4b980415c55d3acd098964ac7f8d5322.exe"1⤵PID:3404
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:4008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 5642⤵
- Program crash
PID:3352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6040 -ip 60401⤵PID:4368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 248 -ip 2481⤵PID:5476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3404 -ip 34041⤵PID:3124
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:432
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3924055 /state1:0x41c64e6d1⤵PID:10424
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify System Firewall
1Indicator Removal
1Clear Windows Event Logs
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\GET_YOUR_FILES_BACK.txt.redeem.[[email protected]][MJ-UK8039276154].lambda
Filesize1KB
MD5db5e1b4ccd329d7ea667ea2a60dcdeac
SHA16c333c8cc231a7b655c90f2057e064026bbef8ba
SHA2562b9ca8c9b8d890b3ad0cca60216749de40b9c9e591434f6ef5f579fbbecf4587
SHA512d483be28e385205ca61de591c156569cbaee00173fd7fc323570a9f1d0980e7368770c6b8ca54b5db48b1cfd0eab2d33066f565df5ca3f2a37baaf34a171aec9
-
C:\$Recycle.Bin\Read Me.TXT.avos.[[email protected]][MJ-UK8039276154].lambda
Filesize3KB
MD577275d7327f965c8817350b34721a8e4
SHA16c4823daef3c1ea163796f4c2652b5de8ffdd04f
SHA2566318506d7103ea199ced5721c757a14455132f7977a23eaa01fec05bf28f2d6e
SHA5123a3a9a4f69584c05c3b7f2ff0cada2cfe7b39a23ad771c7e7737fdd12959dbbaa0c9f70031d210385dee76abc1a6f5e5c40b22f06e298853398da2670a608d64
-
C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\GET_YOUR_FILES_BACK.txt.[[email protected]][MJ-UK8039276154].lambda
Filesize1KB
MD5479191466bd1bf2757127b649bb9ced6
SHA193278db97f63926ec591337f5f843c7594db6e08
SHA256532f06e6d3360f169bf6b8c941dd86c5dc575b3a3a90522ecbe06d4ebc988a7b
SHA5123e1fc58b5758ab0217647d8e2695646d070640be2d3c9dfe1219032a3d9cf0287845e8b75a070d9708439c2eb89535efcb800e39e8c0bbdc2cddf153f31331cc
-
Filesize
7.9MB
MD54939fd6d602bd1a638aa9493c6ba8ff1
SHA14569d4153d6149ee0eba6580df242e76c7d49e72
SHA2562e4aeaef654efba36bb9bb705c20aa6ce1afcbca17917177fbe6348768789493
SHA5129f94021ddf14299d7cfaa5ae3ec26427b087a009c922c9f0855f17ddd4c29190ece24047a7a04524f2b8eff404e731bb0b4d7cccee4c85ac24287c6a63a2a111
-
C:\7fd7740\!! READ ME !!.txt.[[email protected]][MJ-UK8039276154].lambda
Filesize955B
MD52e4cb08515f3b40ab24008f2b5e4d0ea
SHA1a46b6c7b3407d8de3d86c86868b7fc34285c3516
SHA256f5441c95ffd1c04b822a98c4ad88812654e7cc761447aa1f7caf13874d7dfcfe
SHA5126008dff463e4d5ecb73f77f7e04caf853ae93c766cc43c607e60e17e84b62491cfea5739e045f5c91792772c63979c19aa6f3320553347ad0202b18ec0ac51ee
-
C:\7fd7740\7fd7740.exe.[[email protected]][MJ-UK8039276154].lambda
Filesize143KB
MD547d525bde4cb5cc85e2896f70fa61d48
SHA14bdc8647276d525eb9112fcbae473edbb0d81d69
SHA256ce1083a9ba4d690dd45005e8b299c408b783d7ba7eacb344db99eb41ca14b0c0
SHA5126a454adf22a21913c6945c4ec610a9b7e40e3f925ec6c5065662b3ef2cb0e5c9651229e742782bdb01ac501b9b7f19781ab5c0ff6e1d15459825b36129f47a0e
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\AUTORUN.INF.redeem.cuba.[[email protected]][MJ-UK8039276154].lambda
Filesize1KB
MD507d2d218a7a200dd7767c98a60e482c8
SHA181764e74b1cc185dab1199ca775089a48652766a
SHA2566cf5618dea4e0f5903630018ba815edf93b38e5fe971ddb17967059258016a62
SHA51296a59f6376f5aba5b9f3b0d5237f090b08e00b0c89a47a0df6032fe802eb1807a524f935781aca5461a1748f92ff714ddec23d25d8156137959690fcca74d872
-
C:\Depkominfo_Didefaced.htm.redeem.cuba.[[email protected]][MJ-UK8039276154].lambda
Filesize9KB
MD5a40e65f83162415580fe736c030d81f1
SHA133f3011586906dee5ca75e40b7bd3cfcb3996d01
SHA256ae6e1a2fefacb9bf18d555ed3c94015c01af33ebb91bbe3f8e6589609184d271
SHA512e5b3f96d435f2635a8134b0f4d008663d4a10b30680373341002e1d89a963cb3aca42f4548b26410c77e686dbc43d543a795e23d88078a2555414587152bd859
-
Filesize
639B
MD5f7374b9d4919ddd01960f3b0b5ba9abc
SHA17d31360c9156b56f8d067d1113e0dfe8c4459881
SHA2561a8278f742de759e24415028a01b9e2a794cfaeeb1af2a28e55866b64594c374
SHA512140a3f3e1ba55aed832914422a654baed852c74b4102bfceb4bd879f4ed506b31735adc24fdcaf9f46e60b8366c2c179e5be420eff8614d51f58cfe167633b6a
-
Filesize
9.1MB
MD50cdbef79463dbcc0bd79cd498a232567
SHA1b3563ef1e3d9841f3322c93083d0bbebd0cd8cfe
SHA256a96b98a3c0278ce4bbf7f3c526110e1b4bbf9ee3f0fec882f67b0c3c5c8bf0ba
SHA512d6748077fed44bf0dc27fca90550afb0d5ea0b7bae76b370976b281806ca9b588e41199bd46dd6d356b6e2ae32436ec82f809389e19d52aa4fdd45bc25a1d7ad
-
Filesize
40KB
MD54de286f5923036648db750d58ba496e8
SHA10252d5d6c7a3b7dfa71fca4b30a53522fd7c6f67
SHA256eb79555170611879e79b4cdba59bdf679e63df9d7927d01354e5cf859274c58c
SHA512069daaa01a04add11a9e5fc0988b5d42e6ad50011fa148df41ffb3a905ffc170ab65ba66f4ad921306503d8792dd192c173c532232fc7ef146c09aa76ddf548f
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main.css.[[email protected]][MJ-UK8039276154].lambda
Filesize219KB
MD548e88eba703bde583d51d385010cafb8
SHA1f821e4ed56f5628037129dd925dd781cb0152a2c
SHA256d8bacec94c350cfcbff8e13c6b26e5d44357841c15b71a3b947263b91d6da437
SHA512f3cb7fae0aa62d224b3f7fc497a09cc06a078665f2f0198c9531d3bf9a081386af837c5b3660e5151fa938a923a75b5b8d1180e11f9d9931bc1c45cfa486691d
-
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.[[email protected]][MJ-UK8039276154].lambda
Filesize256KB
MD5a7cd7e84131d74ea14fc711d7edba1c0
SHA1944d80341fe3e5b81f976578304c094f83eedb89
SHA2569a226dd6431dbb77635345e7cbbfb0e27efef0f627a949534a7947334090a8f7
SHA5123fcddd8a40d7a210046acaeb7943886d599c975cfdea978b72b5ab723ecf587bec79645ba7573649693e03d894cc36564e60a07a61c8bb457d210b7de6cd2d93
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\te.pak.DATA.[[email protected]][MJ-UK8039276154].lambda
Filesize256KB
MD557d429adfec917cf7c67669540646dac
SHA1fcd81b438d304cb3ffc698c271b2025256c8cc83
SHA256be45d0882348bbf82ac7c7fac7f4cac79529d5f02c9e4cbdb271dd0cfad90de9
SHA5126685dca838257884b74c279e054116d8ec8452f2e85395bcfab23e1b4758238b21abe9acc687f11df597b213aad4df9684ab77438e20cb749ef481436659b5df
-
Filesize
1.8MB
MD586457e594aeccf6bc749a014b8d9e005
SHA160e50dcdbb588ff633cc80336ac02a311b7b0e66
SHA256ff0c9e750291450f40ef5b14d9d2668d18d056b3c931ae157ebbc010babbd9ca
SHA512f94d5512f53d126a257dea0b327e18e1cc46a2866a24bb34b0d8799ff9b3d8ebde640cc213d79a4ae4c18338dde15b9bd5e454e56cf2db28d831b35268ceb687
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.cuba.[[email protected]][MJ-UK8039276154].lambda
Filesize184KB
MD549d12e13cbe24edb340159408bd2a87a
SHA1b8a6121ab136aec3a6b29b372ab4e71ba4630b2b
SHA25680989d880ae6dd5bcdbfc6226b529e0600d2e2ed887e1e6d89b3640dfeaa7b98
SHA512172350ef610bd591ab04e881279fc3cbef9b1a4bbe770659cb045ba0115d05af8237a4fb9fc0c245f4bde43453497089876748810a4b9aef01387ae185eba943
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.[[email protected]][MJ-UK8039276154].lambda
Filesize282KB
MD54c9b8da025d6ac1a3741724259823051
SHA108a5abb5675558dece94c47733995da7e7e457de
SHA256d44ebc846844dd9f041489e55d4270704f8c513d5b42a993338d5f7a39d3b9e9
SHA51260a18f22c38e0605c843cd3f25b61b9eb6083437058062b4d27c21a977b4020314ac5c298e2beb1f04a72c7a2e12514d5f08866fec9204f051421d169e0cdedf
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.cuba.[[email protected]][MJ-UK8039276154].lambda
Filesize5KB
MD51f789780436ad3eafbe884d14d27e730
SHA1d230275ce3056a7f6427467176e70d27085337a5
SHA256b05982a71c5ae5796520d1bf3c0a729f9673fc39dd82ef516a7dcb75deeb1ee5
SHA512ee90739a76588310842b67d8e9fac8f00a0a03f17d2ce4372902135dd58380ee42ab4f702e4ea33014e46975d48fd115959d3a84e530d4df45ab2eb9c1fa75a6
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize47KB
MD502cf30516e2e661bc82742a2c1500f34
SHA10d9a401843135548303a0f550157c953a6412d89
SHA25678ff06a7d9438ac705fc2771dcfcf4eaaad982a89e87895f2094bdbb96735aa7
SHA512368af5d297c00aa43fb05d1a0c4b27e60c630f6419a5f29d44129d4c3887786deecfffe488e4e61755216ba56d8d7daaa30bdaf0205cc6eddbeb8ba7b9c5a986
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize50KB
MD56f7b5ab501a1bd2b3984f2eacd2f7ced
SHA147dfea05470e1754d58995e26e253d6381dccbd2
SHA2562513c2f71124f1401ce89b4c2cab3d54202148f4197ca3957c4f666791e1d03f
SHA512c78aed941de3110d638e31fd3e5d6bcee9a117703a8db880e55e2bffd7f64363b9bcbab31041f42999583c4ab45fb7880e2039fc8d428bed0642a00e408b9ef5
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize51KB
MD532ca95ed66b31e7f4bba984e1111276c
SHA16985205207299db1800b04fe1aecf77cc11d4788
SHA25663f3879f85b77e28e96fd9e0bab6cad3a76c3ac90f874942d12c083892462932
SHA51221cd3716ea35b0fd57fde14a8f3132735a8ab116c09b8ebfe13c9adf1eeb184111ba0764fb131189528d378c7cf7dd925261da82de1b2b2d71baceb2a6962d49
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize47KB
MD573a6df873e12cca6d583950a09c127cf
SHA164136c47f21d29a7fc6ab6f88839e024bc2f5c37
SHA256e32292dbfb3e294a442fff9d35a3f493f97d9321cfd3bb83f15737948d6182fd
SHA5120e37eaaf147bedf5243511bab2fa01a8809515c5aefa5d2db5b66061d110125b98ee9b3e72075542c037efb827ea5fe3d46e97cdfd2d34d900f4a3f4356a1147
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize55KB
MD5432a5dc98e21c74cf9c03703551065f1
SHA1e3f80baeaa366ab458ae275e494f16e8ab3d9f9c
SHA2561f5809c469a9f4b129d13f28c3dfe1dd963c045b6f79a98ef21170ed0d5d91fe
SHA512c9b809128f0164a5a65f2ddbf879de319a2d9827c4265f8c361a4bbbe7f9d070cc2d9279165e5d59d4dc41fc2b5223f0a75608ae3bcd020a0bd52c2e65edd10f
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize54KB
MD5a0f1716c6de41e0d849aa43541de7941
SHA15170bc05a53e6a14db83ca0a45a552f32b4224ca
SHA2568613a726c3126dffb8e2ed2e311d1f556e46b11d6612e081ee199c7ca229f91f
SHA51205e5e749d069d838babedc35079fa1645388ca5fe1509953a10c974caf795f7f61855e12172838e46f1e1948a678fd648d920fe95f682009ecf83172105c350b
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize46KB
MD57c964ff1115792740142ed4eea40c5bd
SHA176a412d20975e86a1bb31161237bb7581220143a
SHA25656db24ff652cba37ac9004f8752fd85e65b594297cafa038a01368eee663aa17
SHA512f2a8856600c14e9482ce8a30aba022fb41224ffe53abdc1f1f035d3b4c52d312dc106aeac9aa061ccefa5c930e74717668ac27113155c557be2699368b5ac8c9
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize48KB
MD5b667f783417feb76bf7a1a6d9e6edc88
SHA15140a6bb67f671ebfe4f18d607f48701b2dc1db2
SHA256e0178c73e0f3d9fe969ae01bcb14fc977bd37ce0af892298c0c747bac3b33206
SHA512c8763e8614c6ae84186223bd3c5eb761731bc2259e952c5de0696aad79f370d3cea6849bc1c04417f9f50011ff7c9344cdfbd9796e8f69ee821aa13f78ce1118
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize46KB
MD559f68360871ce19bc8d48316880605eb
SHA1b17c22139600e1e954dbb0d311b3786e43b6d217
SHA2564d5380d1fcc37000aeedeb4bfcede8c40fbd98c6eae930e0fb1b85cf76b05136
SHA512f75d3a8d7d359c15b2e4f882bafb61bf7ef7689ca86176136aac2ba3444f98d35623c486326b3ed4b5810c734df904d9bb0da571033c63b1cd344e841ffb2f7d
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize20KB
MD57b33bdf23728a13fdda7de5f689b6c48
SHA16c33278c84114554a9a5981ea737f9cb3d3e2f7d
SHA256166168935fd5ba0126e03b58bbc1918aae7eefd0aa157ba3c1fd0b94e88d7a55
SHA512a88887a9c303e5ad863980b53c22876ed61a8fabe13bb805ff5db976a7bf8996c69fad7a1f7cfd313f21abec9241f528f5ab031146f5daa3914a9c3f38225b75
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize19KB
MD58e3624ed41ed0573049cf5f5f3da2304
SHA1488dfeaba4fb977c74e4d507097be6ef0c65a8eb
SHA256dc4513116418ea0cbd9400d89408117fb4f31d28efb8d971c88b343f409167ba
SHA5122fda5871f4d6da20483bece4d121f1d23e841af8efdf05e1e2264fba4ded9e50faf1fb329f25c0e2ddd622d68b4bb7cf4863a7c5e66b5639f8125d52b6edd7b5
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize18KB
MD565bc927aca38148b8c799278b6938bcd
SHA1e3b0b952e5bdfce8b446c4245a85dffb03115675
SHA25606d6169b7d1e4e94b8dda1962f0fd772c5a04ef9ff5aa2e242d09d24b120bdfa
SHA512c206f763b67c79dfa8e76486b48afc299b357c91dc877360499702914d8f116affcc04f423199eff0668c6f27c97b7959bde13ed431eca9d6951096de808ce0b
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize27KB
MD5b36ad6b92c410e60b3c292ffe5a39ab2
SHA12fe5671548c80e588237d2a90adaff16bcad53c1
SHA25604632aa3961a19ec1661818cf73449e7a3ed98280a11109f3f9a9bbfcaeec3be
SHA5128641d32fc1f57c68ac152109cc8dcefce2da1655f39c33228aea5e1bb6f22b8236f0e4b07c65b75583dda137f2faac92b05a845bb614440d838838b5a48941db
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize26KB
MD518db6f1df4bb0d46307006a136d2d933
SHA114c2c15e69398a3ac68066afd0989ccdf9f73071
SHA256de8c020d2b308bac007d1bdef3508cfb4c6cd76041459caedf32070924909640
SHA512b777193d19517d9f7c16e9de209fe80a2e4751ecc5f1194b5bd800655e202ed914f7a8fd315115360b14d48a7424dc4621469d8cfa90072a4dd23e71289f8094
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize69KB
MD54d3e142ed28b5f7f2d9dc23528087284
SHA146d4a083fb075f9edf8ecae42f58bacd1261f78f
SHA256df0ce688f8d5240e587b2fbdecb2cfdb3c8eec28ab934356059dfc232f429eec
SHA51297ad5060c7252b88548e10ec28f523efa8336a8d7f832a1b9018e4a60cd4a6c1f13dcd2d15473cedfc8280cb52fe90030749e96eada0e39bb715cf14463945b5
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize19KB
MD529920fc20e577242516062ce2619cee1
SHA1ccc411738a6535140125a8db7e887b0f59993e2d
SHA25654543ec772ac94586be04fe7dbda83225cdda7d01a448a4a7124eb5f3ae87765
SHA5122d5d6b4eef3e69bff67e7c270f49921522cc07f3474da778fe597a72d6a21ea6b3eca5ae895c62bd24081cb1bbb5409207123382431c5369139725a95e8ea91d
-
C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize967KB
MD599170a62efc9f1562aacf4cc80f838a7
SHA101e947f5a1fdd05b6b38b4c5ce1fb0306db0432b
SHA256c78648e1531618c3a17e053bcdbeb96cc65fb8d8de6ec0112221a97d4172f69a
SHA51205c5757d4e9ac439f914d3d468ae5fbf284cf3d8a7ac715ced83d4317a2e4fc16c475fba49c7d3a20dc5fa8fd6cffc65521b37c6b24b805fff18a3ac8654f74c
-
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize357KB
MD55ec56d53cd6d6de765d40db4e6c9fcc2
SHA15e8dbfc09636720cb29ddcf65b4d98e451768457
SHA2565909d8a63996d2a31448459be6a1c6be25f8fd6ebcda87b98a01efa2d7cd8e82
SHA512d50b954b9d4a1723820bbfb83c4ba369f379305a7e307a1b6127ac445e8a46ccb5baee53c63534b5cd4d5f76c8e8ee291f5dec239433d722bdc3b65dda865965
-
C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize162KB
MD5a3c6bf68fee6cdd73bda18059101d260
SHA1aee5b4896fde56d1369f49fd3b0f08e7c8c86c6d
SHA2566be7c3a0f91fb0f66b4ffeb8268cbe0a45d99562bd222ea20c1fec715303c8de
SHA5120ab6a1124b5623d8d280b38dc3722793bbe8c6ef170a62f8178ce7ecfef6f4ca5b444befbb482c1ab972409ca2dc46d703facf81154a4c5bee59a8c539cfbcaa
-
C:\Program Files\Common Files\microsoft shared\ink\pt-BR\!! READ ME !!.txt.[[email protected]][MJ-UK8039276154].lambda
Filesize955B
MD5087efd565da6072e75fc59028328bef5
SHA15d0c65dd2780a8ce08e93aad8b72fa1434ae862b
SHA256ea95b7c5d23470a404976b6703d1b34d0665fe9ac9e4bb02e4b0046bd2b1e71a
SHA51299fd54cff713d0d2f08e3ac54f5aedff0f6a60f863266c0237f3552406a13e80c7c54ae36ddd0c798270c6bfeea20c9c3c41fcede1b3876c34def065ddfbe289
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ml.pak.[[email protected]][MJ-UK8039276154].lambda
Filesize39KB
MD56d6974d433ea55ee426e9d0100fc2e96
SHA1182c31bafe67e5ff76cec934700777838581cbab
SHA25673c5283b21bf4ec89e7ae910679a79b68c9b07aebe3755364bf456f012d24d92
SHA512785f4cea5c714a328f12d6afdb9f3a3e2300de8b1053d1b5e1121c74103d09436568f2a81116dd9e3575706e20692a6b9d1315a1edc29eb56ea0c2e993b74eb7
-
C:\Program Files\Java\jdk-1.8\bin\jli.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize253KB
MD57ec7255131d248d2b2e31231b33c8952
SHA13cedeec3e1918448e0ac5f8a21854a871c322042
SHA256652ce1d5281ac4171e592e79d7536dbc3f6f582a8b28290686b9ff21511668e8
SHA5124fceb11fa4ff1dcf0b8a9ffd5b0b1a88368970c0ff08a6feb06d6ca171f8464af8f2a009e88c3acfd0b96138d846deb9f44621af9b825bf74516bf7df11f30b7
-
C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.[[email protected]][MJ-UK8039276154].lambda
Filesize465KB
MD59e5d2dafa82a85020237fc42001e9930
SHA12178aad790913786ccaafea13b8ac951fc87b1d8
SHA256e0b5bfabae11bd65186ba07c4041193ab4585e6768f6ec849ce6ba703f08dc5d
SHA512d67f5e8da7e58b8e9d643423dc5ed0ad42240dc8eb89249f012296d911df8a17e9e48be18f968e24d85485324d935bbd4915eee386e19b6b96ff7ad29050aa56
-
C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.cuba.[[email protected]][MJ-UK8039276154].lambda
Filesize562KB
MD546323cb267004b8ab5a97bcf0769e61a
SHA1eca280eb4b31198179cd61e9055a369b7ce69aad
SHA256501e26811e658515a5ada75ae2827bb9cf15a7247e18d45f6e521e1d2cd2e431
SHA5126c24dfb02060c0200254084987c9f20a55e9c90f287ed86ec73eab305f071db909eba12f76adb66a8306764fc06dd5ac7668a4bc4cb8a2d37bbaeb73a4eb7a3c
-
C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.cuba.[[email protected]][MJ-UK8039276154].lambda
Filesize42KB
MD55eb64241c0dfc14fca30daa963004665
SHA14ca89551932a1404a4919d9c0149f5d901c554f7
SHA256f508f4ce21763440088d02bfacadc1c583ac860c35398d96ace973ca3607ad03
SHA512ce0587f0e1ad04cd916578bc8857d14a404a476b016be557e68d0322fb991967c0bb2636d9c890104dc4d2491737bffd6c32ddbba2d4424756c71c64776ae76d
-
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.cuba.[[email protected]][MJ-UK8039276154].lambda
Filesize14KB
MD5c5af240fe66f9f5bac161a1635f9cc39
SHA1ead2b1de6cd731c426b6908954665c772c11dbcd
SHA256863c4efb29bedf0ef32c664308ce4a9a86a692681faaa37ed139ea6444bfa2e8
SHA512d034d69d335c9c9322b9fa3d33fc2d8b4dc93468f2b53ff18ca019cd7f092a08faf1e013f433e113ce5f3c8723aafbebfb07fbaba401ae8d9bf653a6cd4dadff
-
C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.cuba.[[email protected]][MJ-UK8039276154].lambda
Filesize193KB
MD53886b5a6030647b08b65e77bbd3bd044
SHA1ed6e8b64fc914fc392fb9ee3be685d5d245b60e4
SHA256cf056274c0b999361dccb044a219f055b7f27d6f1d6a12dd2c8e12a1d049f60a
SHA51264a13e221e3593495c75c74d68568045144b76fa5fa7ed5e243e3ffed140b390cfb0496a90ac4e1a3085a1c8d81392df3b9050e097a4d8cf7fe565a37e68d391
-
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.[[email protected]][MJ-UK8039276154].lambda
Filesize182KB
MD57f45494ebdadd93df7e165a33a368b7f
SHA1018fec5ba3ab401b4eb783491519b99a0ffe3ee8
SHA256c0b814dd9816e4d7c956dde80e3a9863fed6f0058d5c66379fe30b0688d9f88d
SHA51205431d8d5c6b02d881380177247fa8e0515d0e102e6a36831d49788cbe391c130d9b0ab2703ab7cd3d97dd4c54adfd126451ec4cc20ba8fe3f4e428f233c9b95
-
C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize179KB
MD5639de1ff1911329d04a437dd82f64a7d
SHA1d9ece406071e6cab2281479128b3ab0ebb54a453
SHA2561e669ffafea5eacd0b2b10470bf0859e081e0ce60a6c8ab0bef0aabd475ff4d9
SHA5123999af78d54982d46d1031de6c96fda9dfff10770033a45fff6dd33840c4687aeed80b33714198e4dc9ae4cd454ea27341db0ba0efb281f7105e3ddb82e81aaf
-
C:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize700KB
MD5981c41367791af5a6fec7ce4bd317a46
SHA118827ec566149bf8a579ffdd304855de5c39d075
SHA2566e1758e1b8293f3d61c4d29dfef5b8846a935d1888e7f4a6ee35ba6209449b35
SHA512186ae48460c8b0e2ab76062c0c7005079bcd565263a975aa8da3f0a0058cfbd49d477c1ed45c335cd3dd4f1a88db33828f32ed0963358d644e7a8fa548e2c8a7
-
C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL010.XML.[[email protected]][MJ-UK8039276154].lambda
Filesize213KB
MD5ba5d6e73305897c2f3a65c0276e39df6
SHA13d793b0f1b277a82b4638cacfb2e7cb31f284f18
SHA2567ee59eab52a37f875f48df00ac3c5e513784e42512a48ca86870ba8eeb312778
SHA51228fe0688dfcd5abef71d8c93f3592b4f3a854808fdacee87a812b796f4547582057ae1a51fb67781e2633de4186edba95fba5d867b6af1b187725386072f0b1e
-
C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.[[email protected]][MJ-UK8039276154].lambda
Filesize155KB
MD5724ff6a368c89c649d8875131b620ea8
SHA12a7e58930d7a11c758005860701a6cccae12a375
SHA256ed00c3d3d3cb2209e90c412a28a4ff1c4efb6b00e4eb481b052faee1fee84b32
SHA512ce48a0e55af79a7aaf1ebc78528180b45c94ec3b1d3ff88e6baf93542e48e3a621319f939d2ef24f00e317d70ae318776f876e582bccbdfc01a225229fabf517
-
C:\Program Files\Microsoft Office\root\Office16\URLREDIR.DLL.[[email protected]][MJ-UK8039276154].lambda
Filesize961KB
MD5ea8cf3f161262263072cf6ac7bd278c4
SHA119fc3699afb6bb0c32cb67c3f9ecda2c96248d1e
SHA2569b4dfe04e319f721ab91917410fe0ae3a1781a9abc1c4301f8a0abda762fc5c7
SHA5127dc70ab5245a3bc938f3966cac48f0a281caac786947eb6f8d61bcd7fe341d653a6d104772c6a9af9b4e8b08d43d9ec5d522426a5979134dcdbb489ddd78e698
-
C:\Program Files\Microsoft Office\root\Office16\upe.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize769KB
MD5b01d477bc1f72c7fd349393b6582349f
SHA16fb8ec21a5156a9dff65c35611f783f6a50b2068
SHA2569e51bcedf0d971505e6cf9d8b9eebe1b4c0d131a66b3b4c9259357b2afa70311
SHA51287bd8cae4e63ae9480a69a7dca4b2d287103c5cabc9c355ff9f05303dde8c972976e3c898d47c5d038294e74508c9eb5547659cd667949c62bdb6649e1359143
-
C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.[[email protected]][MJ-UK8039276154].lambda
Filesize472KB
MD591c1106e2484aee1223a42440c5e367a
SHA1d44433b4df9a3fb3b3c9f699c82315e8953251b7
SHA25667ae76886445767b5818f90bbaa258f85a8114d640016eccdbe85fa7cc33b0f5
SHA5128344a38e8d60e51219073a58cce7dd57b175535405c1d795fcdb975534af092b6d960f0a3dcddbf5757a6469efd26e8b6e3f3b83f40a80cee7a3af947084f16a
-
C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-REGULAR.TTF.[[email protected]][MJ-UK8039276154].lambda
Filesize177KB
MD515f03e9d821ba06ad10fbdd7a70f0e5c
SHA1e5c1dc5858aa200c76091bdffdadc0f9455c49b0
SHA25696beb0be90809246b0e5c8d38289272a3cd7175f85ddb121d77c88ac7fc10bc6
SHA5124b9dc412d33e46d552d944671974eb60c21304d831410558071cb0c2d36249178d01ea30d4ed3607b87089903a501dddb93419d8b341342bc6ca03450d5f99b0
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\ucrtbase.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize768KB
MD56c82de0414fc96c4b9379c91b6738f90
SHA19aef0b26f7e746316f8c47a8bb76ba20d2a01f54
SHA25673424d766cb1c9e63295bdef96a97b9226e40ab9d8f74db61741fb7ab0192e97
SHA512df44ef63c9835b76836424297ef0ba75bacbaae818294d229ea91adc601aea4b0c10caa77525a9236162bdf4d0d45477e037cfe366071c797c1474a41fcf200d
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\xmsrv_xl.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize896KB
MD5a33a4d02a37994077548e898d2eaf578
SHA158b6c3feaf4d46ad030851c424f0f971a80e6493
SHA256340f550872efd6efcf4e983f70fa71c645b93158c7214531da2cb6fa3b248c45
SHA512d25c6fcb674157bfdb013ec2ce3e030e334c90cdbf657031ce7bfb0887de35546dca0cffba38703c867899eda1e9e754fe9af9ac381153c881e5bea0b25628e7
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\concrt140.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize244KB
MD5756e2b5a54cdaa7963841ced64ae43a5
SHA1879f385c1baf3e3b87898fba64a52866d7b0e88f
SHA2561ac8746bd01f67278965925afaaf34a998c1d21c3a9c3e0de8ea0ba2ecd38ad1
SHA51289975fb696c532b3727ab077f62805f46467f514a9db8e7c731a625200cb5e6e091b0751aa24aadcab70cd4688c250c1a7ac47fb78f368aba6343bc90292397f
-
C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo.cuba.[[email protected]][MJ-UK8039276154].lambda
Filesize606KB
MD56c90076cdc3c0cf62ff73761203aeb5a
SHA18d1cbcd977655c4eef665a53eb553b88fd48e285
SHA256dddc1f3a1ea7234d0eec5d8332cabbcbd2b25ee22fe28b2160bca4e09df71261
SHA512cfef3c799e958812f5aa1a9479ccac5706a72a74fa274bc1f4abf931b796b9131231c5922bacf6354ffd85db04a47c68e7c60bdd747e422a9eb0360d96c2ccda
-
C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo.cuba.[[email protected]][MJ-UK8039276154].lambda
Filesize855KB
MD5570c389079c98b540443dcc32e5029a0
SHA182607d748fe8c5f07bad0c726982ea23f510b6af
SHA256233d41e8ecfdb34bce2764601013a8058d010f32a9b20e56d3e71cc98f8d1123
SHA51272c3c1f41b2f785832c0e4e147e0054f173169f8c233d63e01df116e8a87cef8e1d558878763b031918a8adc74f9e797d8ec969fd68442e86cca46dc2de7bdec
-
C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo.cuba.[[email protected]][MJ-UK8039276154].lambda
Filesize551KB
MD516a23225ba5c678b52a27db9aed5b853
SHA1bba2bb6548b3183401d5e04e0f4ab4df3c140939
SHA2561222e62571025b9602beed41e5bbd448b9d8abd9b532812c05657335cf2568e1
SHA512887f9595b7ab2f615706d2e58352277f3b16cc911d382b28c164bc1affc807686ae199711dd0f391d402efe8ac627ed246f9634cae5e60f2b84d4453276bede3
-
C:\Program Files\VideoLAN\VLC\plugins\gui\libqt_plugin.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize1.4MB
MD5dfaf0a76719b00c5b876967ce21e9f61
SHA1966d29bae4f8988e5149d64d0910b79f225b3dbd
SHA2563ac8dbaf593ffaa7e529e0d88dd08354d33ee8466a1c8eb46bef13390b504b05
SHA5122f6a51929d6e550dd1b1dddb79fd12fc3204360fbe4e3d79d777dc9a8e87b73018ae3f8d00071bee72d7bd763b2815516e985dec1cbdd1d69d1944b3b256ee32
-
C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSans.ttf.[[email protected]][MJ-UK8039276154].lambda
Filesize250KB
MD5227ed9b70cbc9e87fe31315cade66ad8
SHA155a50acc2923f8132a28aec033e33943a31eb0ba
SHA256eea682bf7f2335061845a9ab94e9a8dde91f28da8762cd8126b9f4bfc684415f
SHA5121d934dfca19918d930ef93c942ad9607aca8d305869ccc2f8e58a21ac41ef49889adea33fcd841bf730c60279322e229fde80b8a6cfbf4e6757cc00486cd17c4
-
C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize370KB
MD5b77f2a62f46af458ddd5bdd0c5b18eda
SHA1d7da058c03cfd2320f0a85c297db248eb2d19d85
SHA2567068e81cf847097fd7cd973b7b723b685827ab09d024cae09830a97dfbfc73f8
SHA512f97f3a06447bb230791653996db9aa74dd5c365735bd3d678069f64d745e54ff85899ef0f7fb4a29393b845c4ca8fc2b706408d67080f255f17b7a65bf4bfc7c
-
C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize378KB
MD5553d63b975890797b89e7c4586b36b7c
SHA1f869df314ca9481557f71f7e6c31bcd1578acf84
SHA256cc65ad8e6f1392278fcf6fbcf6d0e8c4650a1e2985113018b3290b3091f0b71e
SHA512bfaa0b2b9da0a985550b379a1456b796ec3dbeedfd9cfaec3037d2d880c5bd6b68c111deb7c1f98fd18506d96ce6f01d08b65878270fa3e4a68627c385000dd2
-
C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize346KB
MD5d1ae6b290ea55535fef37e3a66811930
SHA10992edf26981097e53fe8e2ac674b97fe084da01
SHA2568d9e89052f75ce767c4fc004983e75beea90aeec525a058964eae3d6f2015877
SHA5123e00f74ff2a0b5cad35020d0818fa4779cdee34ea8f2ff83993c7ccf3e1e298c014ee4222a72a34a3aa6c791c9be902cd9c131bba624af38e830a9e65701eeb4
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize241KB
MD5ab1eead5840cb916146d99c5e28c8681
SHA170dc9419362aa27a3eba5e590a2b8330fd0951d3
SHA2561f29323e623cf5a55a4e2221edf27843cfc69109404705706a6f5177930770d6
SHA51202b388fc235c60edf676db07dfa7adee96ef64914e1b8efca5f887bf68e4107fdadb43f8d0e16aeee2890a434d1301e4f29d629640c5e4f3c4ebc73d4df7e3b5
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize259KB
MD596d3831edf30e3ee3c9ccd25bed035f5
SHA1a10787dd66bcc68c0dd203e062d7b9b0dcbf7e18
SHA256a430bdc524c7c406f3e78e9eaa148a03a0160cb28780e9bcdbcefbbdf952dc67
SHA5129065ea402df570726c85f046c9e1c52b95b229fcd80d75949250e5076c6a67b57cba6e0ddf3eb8800a13b3248bdd59a6d01007536833546db545035a89e13c7a
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize183KB
MD559fc57005876c92f840baba47f90be30
SHA18158186c071482ac2019315e7ca2c16f67e336f3
SHA2565c7f077906c1cc9703f314680a32e918bedfda8bf47158fe8306c06169e286c5
SHA5128f6a812524b3ec899e03bc068812b32f0c2d69be6de8706aad6e968ef6bd559d60eef74e81270f8b14a754cf424c8312ea8f796e1be193ae14f267e7bb730faf
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize153KB
MD5a06fc03d02d6187e1a88845733cdf89c
SHA11f6ba52701cfffbc6f76c96475a71e3670e96883
SHA256f924ea57e76eaacb4f5d8754894c2b3d4040febe32c8f028b95215847b35b364
SHA512e2214c635818436461bbc92a1f8cab5e6249e8ed864d0683456184b34dea31a13cfd40ff49a95a22a685b7196116429b7f5133c857e74f69004dc74776d02177
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize372KB
MD55780e7f424f5979c78f4670e1869eaaf
SHA10374a62eb8b7f06cf17c9d8711a54fb823ddfe0c
SHA2569ee37fb566090bcfb3b0fbc29448e14743abd3957ed1e19eb6e561dfe2b289e8
SHA512a40313f0fb28914f77c6a300d81e036daea20139244e3913540e9ed33b36d248738c2042e404628beef874e1c9757bbb2bae2744649f8d8c9ba4d41a8c913478
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize284KB
MD5f4e7bde487f9640a98adc2285b020604
SHA11675d4d36a4fac034d5fe6704e532685b9ed564a
SHA25611926ae5331b0e39ed93addeef08278d4d3cdb0a7e565a2145ff21e56b165a74
SHA512338d053c7ec85a353efdbc01f378d92315e850847df12041329d11a80e7806652de6227ce29e6f3f5b4d975b49711412f9ad2eff36d3172956bb761c3b59d2bc
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize193KB
MD5f6d7dd96e11a332d5df709ae5d50408d
SHA19e4c3f137fd275f2627e6082c059dfd595058cd5
SHA256b29ae355fef87095ea3f1291019759017ddfad9a6f041281b213b4bcfa62837b
SHA5128f77212ef5d7bf611dbd8ebbe9f03e96e9123356fd5ed1e723180b8f6b047c22936392a33c7940e2c801fd74eaabe05e3befa346ccc33525e2c98d79e3931c86
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize261KB
MD5e90c042ce8b64c5e24874f84659f6ce2
SHA1c7c9ee1e63bc27e81fc77bf497316da33ac2e614
SHA2568bd001d5e351a292853e761bd35c04e2233efb6729867db7db9afd14ac0e9905
SHA5128cf2c4bb4e69feedc8236f2ef11b7d3f820497913b65f5ced8a8e0f9dadc98c2b0741f6a0d27c5bcd02d0bc2c653792828373babe22f3ab1987a0a797f5eec97
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize223KB
MD50f0317aed391465c1f3d190b5c3e585d
SHA1386449831e341858aeb13a08f705170e3fb281f4
SHA2566d7e788c73990e0c9f18a68680ac1e8c39ca45cdecfb838b565af0d38497a314
SHA5121e7d3dd2710b9e26fc000809635f4f3e862b7d0e9e96cd1db8a27f50cf826796231f52f7d92ce5b2d9e37c7323addd66f870dd028370b50fce32ff41fb734389
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize170KB
MD50651e92c95a4892e5276983adf722b64
SHA1aa599972af50847ea23e3cb681dc67a4bf18b920
SHA256b17bda230ce5108de80efeb0f02e19f27be06da30be80704433fb0aa23634817
SHA5125eb97d2ab8bbefc9981facff93d78c18e5c8dc888263530abb2828fc0c20dbd13aafab9c7c047937c2665d1727ba1bf7896377287deec3c780347655748247be
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize209KB
MD57978bb53ef73ba16ff8f6e9f77737c96
SHA141a837ca8a63148d6647331c4eef6c25d2690aca
SHA256e88403fe29ddffa85f841ea9c824de6983bf99a00d2eca1f1eb5786691804bb6
SHA512a5cc71e8d7e6265e8a3bf4c75be1c10d68cf2cf7306ec46fe120a52bc285d3520405cedd3f0a1cab002011041e5d27322ad80bc384d63fe1dc45be9fd0f3cf14
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize287KB
MD5bf905d1cfa0ff20fcb11ad01f5b7b573
SHA1f5af8420ec59acf0246343d52dc6fe08b9d2e914
SHA2561fcea99170dcaa74a72c12a5692c801df703e6c4329f06e3dbbf82d05fd71592
SHA512ef5bb9dfb7a49d1fdac1144820319cc59851d579f9975374307e24be35251efc15687e934c251d5b16f7e7ed39e855849e303a7e092a7e7a08c12e0089003701
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize341KB
MD5be7753db456572a96e75f6894f62c637
SHA11b5380b5ccaf65fb6e5aa5047fb7037831474e0a
SHA25606420d8d0e8d04b627e5ed6ea0f6c8e00c83be53367af0befa54f07f4e1b3596
SHA51274a3fa79066d3a909d7d60a1ee3036fa4b6dd14c4d857266f53fe5ddf4cb1d8650c029bcb6a149b5dde5da27deaf516121b1b42c44eb4dc187623d33897cd795
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize247KB
MD5503c9dab8405640b9702cec09def6ad6
SHA1e2a7c61f299112358ce5ca91060747f4453aed06
SHA2568d1a357cf21d4ac731afdce87f319290e16017aea1c841f7b4b14e524702e671
SHA512bed5a8306445bfe8f3cbaffd1cfbf8706e14b093f13911f81c0d158529415ee8f1b6f2c2539dc892e8824ca5bf9782457bece2a78d89f740cbbe12def72c6020
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize396KB
MD5ee21766f9a718c068a319ceb4af0dce6
SHA1529158e1667128840594ad3a5468a0a5f6f47084
SHA25655e1351cd409a0c97a51406ad49ccf36dca5af1bac2336bbb0661628c4f878e1
SHA51215d8a3403c76cee6fb5135e0c2fbab14fb6cbfbd2f3dd9dede0568ecd63f85bd382f27c4a7378f1183797313373a0f65f8bc6b3c19adcfef95ed5bb72f25600b
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize315KB
MD594089c68aacdaa651cf9099a92f5331f
SHA1bc97c52718c92f5ba9d2063be0c8d67b2de483fa
SHA256ee8c76ab0cb55295d42253f2b15da2b97f2ef6657bf81fef36f0e134644baa1b
SHA5126d2625fe36d2bbae75c35db56c10e61902d22819aadf16e1b00766210c3232606e476e2ef06dea0bb07b02534d53d054635616c8e79d50536bbd50680223e84e
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize788KB
MD55c1f33ae6b5f925656318758faf4abe6
SHA1a788fa66ea7bc55b5133c0357bff6c6b6901e57d
SHA2569b82d586b615302a2d4f2d0f589ed9754ed7c74ec7ad83df145fe235dee00980
SHA5120ecf051f33c29c383d095176102543d7add85c90678819cc6a7c4d821d1cf8b884dfa31fe74ece9445f3819273c12dd1c2a80ee15d9c90aea3c483289eba0377
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize185KB
MD59f3d2955e64642ab4849521e137c5688
SHA1f0c6fe479c082dd5d3c606585b0974ce99b9f173
SHA2566453dee8239304bf916d2f4594c7a4d546d948d2f796c2e8f085741322b131dc
SHA51230ca4c3a9536c5bd6c20a9b0a1330e2bc733b6c0b01efcfd196c2304edcaacf8f5d5e0745f77a16204bf18a52b931c8231d9f343552d63290f17de24732e939f
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize148KB
MD5846ef1f9887c6373866fa264a316b6e1
SHA1c85ca86650feee260e45791fce618083f6d1aa28
SHA2565987d3051fedf7207c376ebbeac088f120f75eba863d3bc20d3ed889793b78b8
SHA512689cbc725bb62c918999931d1b0cbaebf29b643315492d9afdff89830f0e2aac8e0166d3d102cc44ed4a8a48b0582e8c578b3a05eb692a3b8e3c6af4fe4cd91b
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize851KB
MD5bd1aac94f4a6d0733a4f8eb288fcd727
SHA104ef5b3f8ff81b6415b713753a6c91f0d86d93c5
SHA25686a598d5246b74a6425d1c1ce6a596eecce38f71c1a41925be8ec4c5c4d75cf7
SHA51219dcbac202d7b98cb014bafa3fb2bf12b833173b1acc553ab3c6da37bd0169a3fa5ea8627edb36c9ee7400a1ae7df1299ecbc83024555905bff195979f44907a
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize343KB
MD5e134acb08b433313ee8f193299be37db
SHA1fa8e073828e719b6541826623d7cbad26c3b7d11
SHA256831fb6d6a290db376b22d1810ba420b49f9e163a5c0d20c26a4c9ee1445d4b17
SHA512f8603eb13d8033687b1db0b0f1c96a27860a92c12bc3074f56a615439c689c00c7f1ab3710466775d336d17a4bf13cc6d491555c934c057098d0ac52a9a761b6
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize1.6MB
MD5ee1de7e2aa31f53100a936f01f7b6253
SHA1327ba62d361877a2efb5c3e045d01c570eaba661
SHA256e7aa41e5fb9e0091eb5519e562e2a9a459e96cccb1fd3ac2b051f070292dec63
SHA512c4363d735aca1a3ba08cda0ffc92d5e71f7a165d1cac197c20108a9599f2d5535f6a0a6c0602b59946201bef949cb954e60c5a109ba7f6627636a4e773bcd65c
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize678KB
MD5c646d0cacfcbe9e4359c3eb67155ca20
SHA1499fc0c58e11ccb396fde1aa5f5bc46e7bd7f358
SHA25616df743192907e941c6d39d67596a9172b9f12754c6fa00cb6d8bd5cb2803b8c
SHA5129d6650b9bcedad43fb8d71f13d58f0f523d2f040b7408bc58ba836e2a8f3d78e14ffb163918d9cbd13afd3403845a12e87e4f9d0c00d0f16dacd021dc3c130ca
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize194KB
MD5bac2b9cf2344d95faf418966966e3e15
SHA1baa29c83c20dadf38ffe437b067258ec38d3ec6e
SHA25649561bff57de25319dfa1bd88772aba5f47966b0e656aa1b3d6239b37c5e276b
SHA512915b9f90bb01593f73f4eb56f9cae4a1a0edbeba4263aa652989e1b195d6ac6a8ffbe4aaddea73af88707058c27602fa38bf6e2524ddb34a5ba2ffdc09a8be9c
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize738KB
MD5d6135673bb13bcc92d408dfe9d7e0cd4
SHA10eb3ffb1547eeca284f1f2c08fff96b6b6c4500d
SHA25635534ce2bd34572d07124a01f0196632840fd249acf003696fa1c529708113c1
SHA512934905be3f26ebdfce4a4fc8a1c93bcb344bb0d9d6ec1d50f712fb91ac8663e92cd862d5cc30f8e313737309cdbbc4ae494c8f302bd26a07e9e306872f5d5f1b
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize178KB
MD5305c50cc827f02ddc3e79f25d8f83cc3
SHA1a34cc3dfa9864e320ff8174e688b78eff2cd376e
SHA256ad4dcbb480073e214490a84d56a76817e65f51983928ef28dbe010215b1a0335
SHA512edf2d60ddff2a736a96a603d0023acccfdcf61a45f8b32a4572bdeeedfc7fb78532bfe456e81669bf14df1f358ae54deb8994a61fb6ce7a9a3d37f02c575775d
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize202KB
MD53a879661e1dbe5db0aee5cf866629240
SHA19f41bbda6557e3a60139669c77602de6aeb65c7d
SHA256488460bbf549cf365089c28c25eb0307fbb40c08d80dffd048b6c4fb9e22aa6b
SHA5123e92e4429308407ed5491e5d9fc492d3717a15d59882e966c98d1630a785f2ecb99a64648fb01662b21e877522bd8c15cc3262e65e88209153439bcfc14cf935
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize817KB
MD556d47a27daa9ecb6073bc2e62014d47d
SHA178837c1c090b396563bb615f46a387b6a05dae5f
SHA2567803be4b9f730b9796db3a228e4b1e147a57f9645b7bed58ce268daebbf5a62d
SHA51253f66898c01fbc5e398eeb821a9a465ca796eb8d3dd02f32e9797f0ea3216043643c439bde5bb6f090aae9b7e782451306bf41ee3b98e57ce940c11088ffd0d4
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize182KB
MD5f9ef3b1dc14aaa6dfc47f8a69eb9a0fc
SHA1796254b47825a5b20a1297b2b36f13c26333c1a6
SHA2565f74b3f70bef2db15f772c4cf24e2eb297945bc1b1735c19626cc8bb863f02c5
SHA5128df7441cf2c133f07c24177592e88c13edd0119bafea5c0abccdb7692cd3a7dfa5e9e90f716679afbcd9806a747c87d7219f0e8a8becf2d830356b17f7c0e3be
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize830KB
MD5c5c55480d537f41c2c2cacf0c5b5ee3c
SHA13fec9719e6de279a1fd57fbff7490c3896826585
SHA2564529fff4c769cf63210b9185727b96db015370021c8146aa1728edfb35e49b97
SHA5122df008a7cc51c01d5df0f1443105cc57eac416f3b2be36cd23f1a38deebab542337a9e4a1dbbb26c7ae541ac11e8c757c62babe399ac4a5aa5770163adf00295
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize158KB
MD54f0be4a9d40c6b7a2df12c2aa8686a49
SHA1abeb832e13fb9dbe0a19c090ee7365525b9f828f
SHA256f0399fc9b1c247ad866978addf509a4c380a06c00769489ab8c469b7e25bb390
SHA512f76dced1a307041af9569c403b1dbb7b43af74d24f8b69ffed0cdb466e2bb1485d9c79835b625fa8a48452136f08e8fa1d1cc11376285260a751d81357c485a8
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize690KB
MD546ec3fb95e76b8dbc88ea6e9227e2919
SHA11b22c0d5734a6f46378ffb67e0c4260a0a1b342d
SHA2563737e7e301ef25d041ef8748d158c1543cc921f4ab4d481575e41d45ff17eba2
SHA5120a6475dde27c72d429ddf634a57d96e69248a541cf8ccdb7eba0935886c10e0b291a5212bf13e4b35b368d5103c88e7b1023eded2e7d5ddfd1e49f3fea7ddc8a
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize166KB
MD57bc684595e39c7920db5a0b82befe3a0
SHA1bb1dd328defadc1e2f3679380bb356dfc029831b
SHA256ef7728a0b476f2d9b7744092772cc994fe4a4c0f533b8fe6063928baefd9ddad
SHA5129ec1f8b0db7ce6ded9993bbaf3bd439901359adaefb4c990b8fa7a599a6d9c8c3535bdf2cfd5f8eef92ec68bbcab2cfbd5b2f0f761c32e12e6e5df138b9975b6
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize302KB
MD5781a5faee50fd910be0b3ac3cf97a760
SHA11f34e6ba414497cfa6c56828c33ffa3d299e3527
SHA256e19c4e589a21f4670145fc151d40ca629bf3a0472dfce0b8f6a16cb2cf3ded73
SHA512136d6c63d8c50ebb835d1cb7f7763fe19911f23bc727e403c6894333d3cfa3abf59d25ee972b2bce8f6904cdbdf8add9182a8f58c7c43bf5a08fe7fb919c182f
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize654KB
MD588975d59aa6503a7b3d53df549f2f0fe
SHA14b40649887708a64f421d0705e1a2638d709c3e0
SHA2566f573fc3d2aa735526913f81a548ee7d3f5507c54ff2b74e2437056c315f09b4
SHA512b3725f9b2768cc4837144a23d50cb95b8ead6dd1114704df4be10be641536ba7abc2e768ae0c1a72a493645a6b1db3dd47da2f6aa3871985aa40a742c334b814
-
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize198KB
MD53fedc575e43002f2797d4c4782fe9c35
SHA1e19fe386a0ac0323899b71f1d31222327a987eaf
SHA256cd3ed47c253e824b2ae58b258632a3def0ce7f905d9d1ea43b07ed37383f72f8
SHA5127cf64c28f5aa31c4f6d201c04308ee9fa9de17d9e5eeeaec097d6e75352a953a8f6b4eb379937786be5c993163caea9d144327ec359f379276348ba062f791f2
-
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize206KB
MD56678f5ecf7e7be630d0ba43fca64aaba
SHA17e39301b7ac70cf579ce3b5b320491146ceaf66c
SHA2564b32ad4cdd980080568403e4e3b73e315154c145c2f0363e43bd4f7f9293bbd2
SHA512a7b0518828f912ec6bf63549e45f9f2aa8f4d5e28e349da3bd6bde26668265d222d494dd7a059a70c429968898b3013d2c7bc66e848491e7f42cd0e7101856eb
-
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.[[email protected]][MJ-UK8039276154].lambda
Filesize148KB
MD54f0cd2f582e0f027991ba45b383c107d
SHA1858eff30d7e59e4eda59c61501b5d4b03d28a721
SHA256a5c958430d8384e6c081edbc1325c0901f9f27232488100f91aabf12e927cfd2
SHA5124be0596d61883790e9987dadfd5a11062f7dbabe8192ee716c573388e368ef581b91bb56f61be08e45d203fd6242e2f60fbf64ef84480277d4adddb92a63601b
-
Filesize
1KB
MD5114866e5c83d51435aa6ce41216704c8
SHA13b984aae7aa8eb28d57a9e3df0bbd809af51f8e2
SHA256287346fb858b9559c539a30d337c47552570de818364ceda705a997791872600
SHA512d1880fd682c2bafaa6e8772abfae5a18e57073704e773f93584d3886d70b7e3d0f92358794a4d2094d125f690eaee94f13518e1a64771249721301d4e8d534f3
-
C:\ProgramData\Package Cache\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\windowsdesktop-runtime-7.0.16-win-x64.msi
Filesize21.3MB
MD542f526570ddb87ae9accd3919f1f18b9
SHA1acf9a8b6e6f356c4f5137000ac896e835c338a19
SHA25674f794fbe715558d6bf3b15004361659c0ef3c4cfad8e8c35ad98e9d494c636a
SHA512db457473c79f14d554b3ce50d6a3f994ec4fc2f8f862061c7eeb769216beb88e2d9142528559dcf44c21eee14dc711acad996fd0c26243c118cac25a4d014bb3
-
C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\cab1.cab.redeem.[[email protected]][MJ-UK8039276154].lambda
Filesize448KB
MD5875949579ad30d278dad7b3044ee5064
SHA1fa0fbefe17814552eb4b116bfaf8e4a7635c8789
SHA2560b9ca85e10a345bbcc44f88876e997f65d6f17e40c45d7ac474f054b00a005ae
SHA51247f66d38d83942d2bb924d40a8e4e3c514c47327d50e28953d20c4f2788ed663dcb8f71a46b49816b6e552c45ba4641044e2aaee251cfc4dc2045e6fbb44a925
-
Filesize
1KB
MD58d8357ee2e0f1372026543f02eaeefb3
SHA1daf5f4e97fc8472ac3be7b86c996d429769edb9a
SHA2568cb56d4df999f693b3bb3015fb2b8353d2f3b3c5c82cfe66eecf4baaa69f2cea
SHA512cffb8438a4ff1328deaeb182f9c77b19bc5100e37186b298cfa9ef5dc9f055c4abf03b243e57bf17749cc92cf9ab39b8070e28b2dc2c3bbf8d22001d16c8e921
-
Filesize
2KB
MD5a456d8755b5ca487e440d06efd02328b
SHA14457e9960a47c6c8ac4424def0cd4096460fd068
SHA2565dd95a843dab96daf8516450ae5578faa4839d52061f41cdd58b235ea3c6e634
SHA51240f44d3a4c0442c67efbe3e23f679dcd91a1f66c9e846dc6d9d53030727f434834257502aa786c220ee9a784be23a81b015a2c659b474e8945714f5aa9af8232
-
C:\Read Me.TXT.[[email protected]][MJ-UK8039276154].lambda
Filesize2KB
MD5e6c2d8a21c6c5d2bce5eb0000ed07f6a
SHA1b808681aab312d9ac106d55af5bdf0f159fdccc1
SHA256b58867a8cb34edd6bc1da436ebd4fe88fed593cea68905c5837fee347e414d20
SHA51229a5565daa225cbce72eb0c6bf828d24f107cc5104392da5da53fca663e56ffa6740cacb934447472ae49560a252d1caca5f04eb7cc65cd362cbe529ba7c1d41
-
Filesize
64KB
MD5d2fb266b97caff2086bf0fa74eddb6b2
SHA12f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA256b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
SHA512c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
944B
MD56bd369f7c74a28194c991ed1404da30f
SHA10f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA256878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
SHA5128fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe.[[email protected]][MJ-UK8039276154].lambda
Filesize192KB
MD527de9a63f6284bbacb1b549966f6abcf
SHA18f98978f712fe64fcd0e3cf0dadf7471b569a96f
SHA2560aaa748c1abbf87abdc65ea2a26cee0bffcbabd2ba707df93761c17404b2624c
SHA5123f04ff760d6187654466613a003db90c0ef64de3b563bd13849c7aa56cf34d1b55d6192b6df2c9f710c124c8005e19e26f43bbb70bc3a81340bb0aa8205b7f18
-
C:\Users\Admin\AppData\Local\Temp\7zE443A06A7\00482\Trojan-Ransom.Win32.Blocker.ngna-3666316716fdd6f6dcffd23dc1b30c9f2b664336698e248ed52d0b6d499106bb.exe
Filesize7.9MB
MD59cd078656ed2839ca01948a210f28185
SHA1adbd6755a7f2ac6d29e38fc80cc71c4f9a571d91
SHA2563666316716fdd6f6dcffd23dc1b30c9f2b664336698e248ed52d0b6d499106bb
SHA512cb7dcf74a60fa8bcd0c2df22cf2eba1b2fc55f3e49a1fef781ef8dd34724921264ac729a897219c0fb75c72513a14a32504a69ec1b7a42f8eed8661ac2f5af1d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
31KB
MD5199d89028a54f3a74d49a68c3d7bba4c
SHA175b92067d149cd4743a8a9dfc37beeb38d64d1cb
SHA256f830929825310fe601de392d64fe4128c234b9a503f748c3cfa6b18b574d9ae3
SHA512d48e984c9c8073dd1209e78b4bd95b67060191d7ae3cf128332c567a04aa6f720aa061a937440e1d8e2f3783850d0d9fbcd2c56a04b9259d74430eca638965a6
-
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2B28.txt.redeem.[[email protected]][MJ-UK8039276154].lambda
Filesize128KB
MD56d41f7026ba48dcc7443bcacd2496059
SHA1802c0d5defebc3faadf89c26880364dd4ecaa02a
SHA256e0d7ab194c99fb805e2a7ecf2734356a026bb0b82108b308f8d22b2a12e39373
SHA512f66b126fca8ceaa77c16ef511c7f55468394c7078af86ce4e8c3925c7e7f9efe98ebec13a0704a66ea01410e56792a960a6c75bf2ac66780d50aa2d614bb6799
-
Filesize
2KB
MD589aae6793abb61c350c1b7b674c0d2da
SHA10b9470d9829b0a306002f3b945778e1c25cedaac
SHA256b3d7ecf12163404a872bbc295174ffcb447e059b0e1a935910df14b71c0120a0
SHA5121527abef977418d47adf8c209464e11f586cd8c6135a488ab660f2c4b489f0025a479521322eb23018e4a7aee511afe12c9fedd21c27a5588d6f53c96611c891
-
Filesize
52KB
MD50c35891923e160caaafd35651460de7d
SHA10a7488c09d5deb2e131e10a38180fad4ece23fa4
SHA2561bde0a0c495958f303a4b796ba715171fe5cc0d32e6cf9d69b32e1a35e94689a
SHA512ba3548be461a58bcb8d4c71d0bd22a79c89c73614cc44c0e45197013d61249ae16b95327a49eda139fb5384af066a5a76d477d3406f17b8f5e8edf6d243e9324
-
Filesize
58B
MD53e80d7933380763dcf4655ce4a7aaeba
SHA13618c9fed9aaa21c207a733be5de4955d3034b4d
SHA2560c5309eadcafcb36c505d839a2b4ee89357193c8aa3fd450a832ea428b006cfc
SHA512db00693401e7bebbfa02c31e6863c6c5a603173e236b1f964bb8d734a17c570e4c57edf890f3b14c1b19fc1f16aec268e24df5a0c6077108568f0d0cb05aa6ee
-
Filesize
143KB
MD53769639c17f0cd5045964b0839c9f009
SHA10fe3a16efd24b51740aed67e9e8cc9f4325151fa
SHA25603467f231a3fce6795545ae99a6dad161effa3bf681031693815eabf1648ee66
SHA512263b1291fb981ea28b3a6494bc6636a63784ae58ca9ebd84b90c52ef1941bcea43ee7e90e464d9510f93a043e10304a13d91beaff51c03d52ab604128e020a39
-
Filesize
412KB
MD543d98c1b544599c7d71991499bdac1a0
SHA116b2def2935f8494d8fc87c0caa763744bde41fb
SHA2563ff29804ebf38bb4dd80985971848dae2136e55bd60dca68984ebbe9b670a719
SHA5129d2b84b0cbdf09f2976473a1c4d2d080047f8bf37ad0e984a22c72841c94d96a323dfbb88bf6fe3b7e57a6224020c5c7ca5ca089bb15833103762213d1b5c0fa
-
Filesize
1.5MB
MD5e7098ecde9f0172f4b714a9bb930543d
SHA1c0b92f9ee00e9106ebec464dc76d0118fe1a6a8e
SHA2568cf179cf6ca8a94aa561297d8621ded8e26222d34b93828b14396054773eaa16
SHA5122fd2f12d5b7c206af650da631245ab4dfb92924072d8f4964a3c16b7838b8ad4c5c891f9e4c225e184f06e7365dba7c1fc7b7405affddf76a0f370b6494042ce
-
Filesize
1KB
MD589063e018c94e23fe87f896990ec25c6
SHA1825219324af637e92eb5ff0f66efff20bac946d4
SHA256755ecb8fd0da33e0afd472831ca636217f8dcfac6bccd0e53215fdeb031d38cd
SHA5122e802d85901b1012a265d29518da3df921c6b2dc8d2f7a6dfdac9f9dd57ab1697494abb65edd1ec39cbe0fb5f3e1e1f2b3d351b584f5b46b649cf482a47993c0
-
Filesize
1.0MB
MD5a2f259ceb892d3b0d1d121997c8927e3
SHA16e0a7239822b8d365d690a314f231286355f6cc6
SHA256ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420
SHA5125ae1b60390c94c9e79d3b500a55b775d82556e599963d533170b9f35ad5cfa2df1b7d24de1890acf8e1e2c356830396091d46632dbc6ee43a7d042d4facb5dad
-
Filesize
1.0MB
MD5345983a3f8b64e63bb5896bb0d7afafe
SHA18b542cc4891d284c93a1a24de766c7241c7f3570
SHA25683a102edf3f6dc7d78c06c665439d24de78c32f2dcd5547eea0ebc35c095df19
SHA51244b2640364934d0dd9386d8af2bfd59ccd321faaa17dd33d6e5968eb2c377fb425bcfcf469ce38ce2988bae9ba64dc7c36cf5c742e8b966584b23ca77ae082d9
-
Filesize
1.0MB
MD5f18307bb26746dfc07c7d043242db3b2
SHA1100abeaf5a8f3274d3a943d440b0ed370a9cc302
SHA256c9bf723437b5fd41db4f55e65767d3ef44093e7996feace18940a03ace1575e9
SHA512fff6c768563331aa88c4d539868248d6868c6c74204ed2ce28f72c3356722580009e0a5df4df77d2ae3f694c57cdb7420d3747747111351dc46737baf4e3b7b0
-
Filesize
1.0MB
MD5670387d784954b950f1b0ae8510db339
SHA13e9eb35c1f08fd7b5ba3eaa9b7eba4ce7e5141a1
SHA2569dd190f323ad2332ef66789d04e8de0ea0a58d540aea2c787129fa827c15f633
SHA5120750d775270cf1ebaacb9ede07c8b881e0343c1dc7fa3e343145ab664065dbab896fcabf16135b595a3846b6262cff598537989ac5e521b638e6d81c11a5772a
-
Filesize
1.0MB
MD5a70c33bf710188503327ef5cebd1e512
SHA1cb533336efea5332a1618fb1f25470afd628e9d1
SHA256409ac008c95c0ef261d83abaefc4ac00400c7a9b98320c75bb8401c3f0f8301b
SHA512082026c99ce82e12592df204058ae8db9a61a079cf712fe184c533a083f11daadff114a89184097e073032158ecdba4b3280544ba2054082116688ab0b5f11b7
-
Filesize
3.2MB
MD5f6ca906c435246ee510784399ec757fb
SHA12ee286e86f35f8cb411e85f4903408ca653dae5f
SHA2566aba0494180fbde7a85fa184c1fa767df1bfd4bca92101b737ee9774226bda81
SHA512e386950ed61d0c7f8c5ac78dbb39c3ae614b08ef591091ad93ccf105244698a16ceb9b2262b3ca6e8a24fd8bd1a90db293276bb389768b84c42d03a48be079d5
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Agent.gen-d2080b0b0f087ebe9c16d91a25ceb1d5d4c32bed258f4dcb91c3b83bb0070db7.exe
Filesize289KB
MD5489306e0514b37f338215c607269f0fd
SHA14c808796df4a6c9b46e2dd9a2a04a0f6db81aef0
SHA256d2080b0b0f087ebe9c16d91a25ceb1d5d4c32bed258f4dcb91c3b83bb0070db7
SHA512a0f8da3839d8fc2adc1b9e7aabfed4adce8f340e99391176413c638cd66143a1ab1338c740fc91788f9444c3e32490aca364a85e2adf311a5b25eafea81551ae
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Blocker.gen-174baeb61d7db21bc0034a6add46e2c8b1579b9e0be8bedea96f612debd7b14d.exe
Filesize10.9MB
MD581c5a04c98ff63745508559b324894ae
SHA118976590e2a23237a0c63b9c0aceef229cbee3fe
SHA256174baeb61d7db21bc0034a6add46e2c8b1579b9e0be8bedea96f612debd7b14d
SHA512d3302759731e3ce35cdf27e18d6780e0ad7fe8920ba91e4701d1f3e560b6f499d0b3b5eb32271d8228e6e6a93f0db1fc51b4231b1f8921c58c1b13e084312b08
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Crypren.gen-0c60599f5e5c8172c4b7a551f3ba4b43aeec5fea6976bf8fd2b38e5fb1ee8f13.exe
Filesize400KB
MD525a02c96e64831c4b4d4a22564f4cf57
SHA1cc76d6529dac6dd6d4258aa91aaa0326da9dd873
SHA2560c60599f5e5c8172c4b7a551f3ba4b43aeec5fea6976bf8fd2b38e5fb1ee8f13
SHA51293d0d4d8322e330d325d4387a4ea5293d4789c1f669970f0337bc2b95165f6c1e5718247305442afd574c66f9c6e9de16dfbd26061f3ec24e45c936deb4c738b
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Encoder.gen-1d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26.exe
Filesize824KB
MD57d17a868abac9de81fe79087eee31471
SHA12d3f58ea051db43964243b8aefb7279e45e7bda9
SHA2561d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26
SHA51285ec6c3cf0908b306712041fc9d971d27349641245c29f126e01443dcc6ccd78530c789b15d345938c194009c890b42f7c95bc65deae1ef7372e5744651f9540
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.MSIL.Purgen.gen-77181bf77dde9838240d6ae57aaf37d2e96cc089a5bdd8c530a9b5195c290851.exe
Filesize80KB
MD5bf6c69f9ca692937062ac51b8d70c6c1
SHA1b70f3bd1ee7ac687f64b9cea11b443546b98ebe1
SHA25677181bf77dde9838240d6ae57aaf37d2e96cc089a5bdd8c530a9b5195c290851
SHA5128122bcd5da063dff21d7164809aa42a6d64aa9183928e95a208fa346c60301405dd00d62768be528dfff25effd38d0416845062b706e828ad7c74ce3ad1d8d8f
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Blocker.gen-6c2fd975d70bfebbac1ca3661f8abd7308b8542a036dd8abfd223b1b78d58847.exe
Filesize20KB
MD5e97f76604f41b1face7c09e5da8a24d4
SHA1ef54757252e9da5cc193fc515acdf5f11815db37
SHA2566c2fd975d70bfebbac1ca3661f8abd7308b8542a036dd8abfd223b1b78d58847
SHA512db815c4333a1fece6282513401f227e8d904024636b2c9d27d5cf900d17c3c26ac959ad95cadaf07c48f7587c71f60af6f6474dc0c8daa36d876e479d48e9f3c
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Blocker.pef-f274951a2e7bc1d5c4e2c5ffd8bb93efd1ca9abc7aa1fc32f0196eec424a4f39.exe
Filesize52KB
MD5eb3887b74bbb2488a51a2b7c2afed7f8
SHA148c36fd41eb65cc8d8fade24dd86bf78e1084670
SHA256f274951a2e7bc1d5c4e2c5ffd8bb93efd1ca9abc7aa1fc32f0196eec424a4f39
SHA512c3e9f876443ffca83c68fc259aa5ff7d03a09dd724728d3dcd07af8323c169fd3be92404c4b5d48e7599abc1add0a3b55c2eddc9a028fa254fa6d851d2692953
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-63064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b.exe
Filesize1.8MB
MD560ee8a352264cd703fd264769cabf408
SHA107eb4cdbcdff2f8a9c5c181ea0bc5bd0694afd2a
SHA25663064e7098dd5834bf63c40f0645d1fe6be93de9c59b0028bbdff3424d7fe35b
SHA51281a7699cc42f0d766d7e5557515bdb0cb65cbd4ee16e57294fce06c43f2f33dcd280261e68b1d8377c88a6f3c2b2733543804cb2b1052794fb75ac4b6400fd80
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Cryptoff.vho-fd9867c02033d592fbaa4cce9eee14d7d1b6bb90beb5fb5b12379946311a37fd.exe
Filesize130KB
MD557a9dfdf84c6a84481aef36a8aaa7680
SHA1ac9f86fc99196dd52582a65db01d0e902f50d803
SHA256fd9867c02033d592fbaa4cce9eee14d7d1b6bb90beb5fb5b12379946311a37fd
SHA51245004cec749ba35a64c7112d4a91cdc443039a17bebc4e861b058ec230e8b81abcdb2297ae306447336c92b6429378ec16da7e07b5319fa6df331c87ad699acb
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Cryptor.gen-1b53c48f6dbe0eba14631c633e941417014125aa731b5e2f4caa444e1099d13a.exe
Filesize691KB
MD50a36718279e641988b6345fb8848af28
SHA1db854068b9885d91bfa0559a90e3f329ac0bfbdc
SHA2561b53c48f6dbe0eba14631c633e941417014125aa731b5e2f4caa444e1099d13a
SHA5129dea9067cae147ab474106240df5b7a9ea7483eaf5eefec5edcf5d4c9b48261a0c261bfac2c2604430f8e522e49491aaaf5fd26304a6a10cf664341313444688
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Cuba.gen-adb12f4ed01d1f59ffc45186fc85d502ddeebfd26438aa2c7e4383566fb9739f.exe
Filesize3.9MB
MD5a455006935e4a276917175f6e48a0b74
SHA19cba52c350eda90672ce634d5b37ffcec4b5cabc
SHA256adb12f4ed01d1f59ffc45186fc85d502ddeebfd26438aa2c7e4383566fb9739f
SHA512623dc1f0dd08edf2566fb65b006c5a484243d9ae8553dd1e7539abf128d99cc98f6728a0c7ae4e0456e8ce9e6764934a0113cb74d298e9528af2998d4cb3c978
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.GandCrypt.pef-afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72.exe
Filesize244KB
MD5b6826dc8c9582ca83864eb7a23734f98
SHA122f2481ee80838a5c6558265e2f259c1eeec1499
SHA256afb594d44889eabc8ae1fde68f3ce3344a23ffc9fef251e4c14af948b2c9ce72
SHA51258f4e82210e87babed12214d89ae6b20ae3c6528e98fff9350ae494d74deaf3177727b113cf4683cd461f53f47efb4174de31db1ff19abe59e87d8c89b84acaa
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Gen.gen-cbcc839cbe4c2c684dfe9fcfb16ed261d9b6b2a73a404a45fe740c0f46bbcc23.exe
Filesize440KB
MD54067c4242c7b6ee5dd1164d6eab53eeb
SHA129b9f9162d8efd50313a2b1ffeded329d7305b7b
SHA256cbcc839cbe4c2c684dfe9fcfb16ed261d9b6b2a73a404a45fe740c0f46bbcc23
SHA5128a5342ab2d81e7fe8f8aa98442de606bf5c240c418df84925606d95744a28219a258cc4ec1e9024cb88c3c5375114ffce73c1a2c923de40954aaf1cd257c3d82
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Generic-2ca977fd3323e3e4997747476965c2251feccc466809e3594ec1fec47754aa2f.exe
Filesize5.8MB
MD5117323b7aac19102a70eb4d5ab8e5f7b
SHA1a5d7e43d9eb9076b74b5755be4f8e51d7440dc9d
SHA2562ca977fd3323e3e4997747476965c2251feccc466809e3594ec1fec47754aa2f
SHA5122109a6576fdeb7eec336041aa8c3680f38d09872607ebc1815ee0793ec5d5d181a48d3d37622b4af4f0bc6f1ddd6f9f508607d126c3b47306d835176e797bbd7
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Generic-70aa68770bdd23400254e08045cba305b674d5c98bd5f9910b9672c76fe5bb0d.exe
Filesize1.8MB
MD5746a47884a4eca844cf25cecaef7b673
SHA174369f9891f886002e539ab9cf9a19015457c768
SHA25670aa68770bdd23400254e08045cba305b674d5c98bd5f9910b9672c76fe5bb0d
SHA512a048bfa13a2de087dba6f41a9a860610374024029a6a2b0553969f14420113bc32a83c800ff82cdf755685f6bd5cf702430dda10c1afcabefdc6b5a73f7fbe94
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Generic-cbe63721845f03919c2aa83a4a77280b14932c16fb68e3a46e8c367e24a27909.exe
Filesize1.0MB
MD55804fca0fc51d705abb4743fc4b1ace2
SHA104da6359b5f3dae9ca5a7140e6b4a3e1369934a4
SHA256cbe63721845f03919c2aa83a4a77280b14932c16fb68e3a46e8c367e24a27909
SHA51265e56f819e5c8ba60c6cbf5c3a6688910f75746d4c4a68294240d06b24cd3b7edefccec83e0605000385977daa74f17e51c29c5d8489df6a46fe25ecdde843a2
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-6f9999a53022f6d22beabb39406e849e3cbbd76e645f2148386ed89fbb94a133.exe
Filesize7.9MB
MD58a3dbf822fa4bb781eec4a5a38848414
SHA1e939f87c0d695159aba1fdecb3b52acab1dd4c71
SHA2566f9999a53022f6d22beabb39406e849e3cbbd76e645f2148386ed89fbb94a133
SHA512c1a8a37867b598069fa6e565600dbfb3124925a64d95ebec5f09f26c1c153a75cad88061cdd5e42b859fbf048db734b6da239bbed42812006f3b682d7b9be8b6
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-144c5a85c642ef1376771a548acd625f4b980415c55d3acd098964ac7f8d5322.exe
Filesize13.6MB
MD5df27cceaa63724143e5eb5d2555a0bde
SHA17bb35b51d1c02988bbc2fbdd8a5bf3f2a60d23a8
SHA256144c5a85c642ef1376771a548acd625f4b980415c55d3acd098964ac7f8d5322
SHA51248093b87d83158cf834c732d4f70bbee571a5a8a90b77377f54831cfa4a1bdbca4f17ce004d2bbd4c7a649bab13a1d2186eaddfe5f64716a3ef678f2e6619abe
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win32.Stop.gen-e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36.exe
Filesize842KB
MD5353bdef6aa954c63f216ec1a3b6bb324
SHA11f1fd79fd72c9caad2fa1114ff26728516e63984
SHA256e4a3bedf9b6eb73e8358ef9668d05bb72b3c8c8c8f26ccedeba1495ffba0bc36
SHA51277078efe2158ace49f974fa9e2129f3947fea2be313c3cbd973ccb0edefdabb8fdbf759aab34505105dcb512b93d63936c308a05910e4f50cccc20d80c923e59
-
C:\Users\Admin\Desktop\00482\HEUR-Trojan-Ransom.Win64.Magni.gen-6b48456ec6f186c5fc46d425a05f7f83a3e01955097dd69371e235d60f234ac8.exe
Filesize2KB
MD5e7d02c59c35b7f7ddd42a7e1d859c549
SHA109bf0c2e2ab146588702caab09d59ba227510c2d
SHA2566b48456ec6f186c5fc46d425a05f7f83a3e01955097dd69371e235d60f234ac8
SHA51273c987c77e6ad82b8a52722586550d014d99397498dd8e2753dc1f847dff22ac2c8078c5eff9a31832ccfca1c77516c235fde1e4b7813a7ab068a1b52ffd0057
-
C:\Users\Admin\Desktop\00482\Trojan-Ransom.Win32.Cryptodef.aoo-0f44655bda32c5bac1d24c46ae08999072a6aa140470129d13a8bf0686b66f2c.exe
Filesize69KB
MD5da3dc130d98e26155f67da1087e93b4f
SHA16838c5a67d2bf57218e1c37ec6a4a0e7d17c0d41
SHA2560f44655bda32c5bac1d24c46ae08999072a6aa140470129d13a8bf0686b66f2c
SHA512533077bd72a5ffd1bc0da8d3a94a25c27b1c8fdabbcc8d89171441e7f7c26171721b051b17085d9ebb9ea261ed5468c6d692ec9f5060740eb2c2da609b263698
-
Filesize
870KB
MD5bafff88147e0ada62995b786022e0ccc
SHA117b9a2ec77304cf0080b59afca7b27eb1b81f360
SHA256b884812210dfc239230fa7611adc9b08fa64604a3ce0f624e61b3f32c0a2bd30
SHA512cec416bc455a9399d9ed1ddd1bbaed8841b7dbf380168c10fcc9a5d296b28911ff95b1cc9b15d2fb42868818afccce8521ddff6888b324146e1b9a206545b5d8
-
Filesize
1.1MB
MD56455c44eef42c8600bb76950658203c4
SHA16b241b3bf8aab2402e7e452b33017244cd2d8fcb
SHA2563c3276e8552d4be8cb282ec0f3954f275a53f5d8e8aab32b13330a0ef34ecbfc
SHA5128b0524a6899e3d563d37190e6efa0e6e7afd2cd28226253d654307cec222eb8c37087e7fb94132f18f9aba206c8ac519bfb4be53aee09f4c4030e6f9929c816c
-
C:\Users\Admin\Downloads\DebugUnprotect.vbs.redeem.[[email protected]][MJ-UK8039276154].lambda
Filesize64KB
MD51aad418b929dac072fbef46928e1a45b
SHA16f9567f22cc53ef5f7ba04bf702dbee3849ac193
SHA2561963956b8754cd276b1645fba6f02b4e36d48d784ecfb926def0a2aaf3ac2665
SHA51275f983e75ac5c3f631b65c9ce5c51b626a747a60885f9ef9a78e0ed55508ca157d912922c949ea449186abb129252de820d5d474c18bb306a02eb895ab24aa44
-
C:\Users\Admin\Pictures\ResolveStart.pcx.redeem.[[email protected]][MJ-UK8039276154].lambda
Filesize128KB
MD56ced9869692a6a1f18a4d54e98bf11ea
SHA1292f245f22e86ef2b7b2bde98df39e6bae26468b
SHA256518f4360e3478d33291eba76e88c4f06f80ef266ff11e564805c7ef20098f84a
SHA5127db12ad2e03df22b6fb8d017f0ebe7f17e16df9a39538126d35148b9a4f9f62084a873194065b0a343029697745b6f59cca61943ace8aea4375f5111bcd2c389
-
Filesize
1KB
MD5a6675383ae130914b6cf5ef85023a52f
SHA1cb370518628104c2f804933c8808150072db9922
SHA256334cdde2293c659d6b91c72e0a00a63a025580cefcdf393a6d9d70d21bc239ad
SHA512f0d924cc66a7468bff4b6392fe331e77287d5a5ec3436e4926a711789d009f41b3d6f7c6d6e3efd16400e33a502a258eed1d110024ba6f7ceefaea170d82d741
-
Filesize
1KB
MD51c42ab29bfdca32ca30582546eb3fd02
SHA114b3ceda60edc55acec5d79dd66210de6d4650c8
SHA2569f2b1d61443e996ee20caf05953171219a412285070997ae83fcd167ab50efa4
SHA512b87d14cf60540f906e7dd23f8e8bfb68ae4d3849a0e215e28a8fb20caa1f324746f13e4e136e924e2a3b57e5b9ed28076bddf53394805092d61cd0e05e2fa1ed
-
Filesize
6KB
MD57bd45b4353c2eb076cb800af6794c74c
SHA18b43110b86ab342a3a50fba1101af23e58afb81f
SHA25646768646ca5a5742bd66e10f807c7d85c06d67f34d01e1da68c0ed585e81c74d
SHA512a41d292080b01fa6884140f0aab6a9a45310ff8eccf850715d5b373c8aeaf0a57ed060e12475621372876ccf05d64278f89ec9b458d3c1af4cc60b5999f735f3
-
C:\vcredist2010_x64.log.html.redeem.[[email protected]][MJ-UK8039276154].lambda
Filesize86KB
MD502c1a3fc0c54f09a790ac5bd355f4187
SHA1b368a7f7ccf70620dd028194d59b8b2473ac1d5e
SHA256d07b3e96039b20e168adcb7ce6094659c280caca41b86a1214defcd2f255d33d
SHA5121144195ca65f98576bbaa52e6fafbfb9e10285d926a214b31193e50a46d04dc39420bf2f9e69c44bf12b7028091b5baff832b2098d46c60bab7bb1e7ab61e809
-
C:\vcredist2010_x86.log.html.redeem.[[email protected]][MJ-UK8039276154].lambda
Filesize81KB
MD53a10e8c0b38483e6cbf27e3a025ed525
SHA14b934be4678ec1c96be45eff4738d3795838ab7a
SHA256341be6bb5a0d1cc6b660f666a44f23b1804322322a19af27647405889a41a595
SHA5128201fbceb4567cb56c4bd4bfd2a7b9fb1d51501c7d6a929d7b82a1793941b5a2cb9bff0531131fce4638425c9952d9781e54ab7db192ba636f8f0d72f7645b2e
-
Filesize
195KB
MD5875ff38d66cdaba9028185e63f161269
SHA193e7487464993df04989b95fe7471c0c865e226d
SHA2562ca59a3319c52392e51876104ab4ee80d553f894bf3b778304bd8158c3e37fb8
SHA512a27b55f2039b7c059bfb2beba30ca8e6cd16689ea1d23445e4d407b69a6d6f68785850787cb64869c95904440c998361ac2f590338d07fbe9ebee2fee3166a56
-
C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log.redeem.[[email protected]][MJ-UK8039276154].lambda
Filesize123KB
MD56ddc8a79c1fd29b7836239083c5a695e
SHA19a1f0b7f8dc1488718666bc1095d33ec1b8d0e91
SHA25698442b92a91559985418fbc9388baae88df58945613a269672b8b1d471f9b5a0
SHA512f23b24ff503028cca7ee68966258d8773bc2498d0860b8b0066dcb2d7e3213498b98d9d2fb8f89f4755f0be7ac890e78a0e0e728c5932e77e1fc812790f325bd
-
C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log.[[email protected]][MJ-UK8039276154].lambda
Filesize130KB
MD5371297a3941e3a4dad1e95a63fd27359
SHA1ef58512b874ca85f85fef192e8a9246253b11a1f
SHA256e7c253c514f45879547f1e053d27122b7eceaaf0a992d4c23a6190a90aa46775
SHA51255e94d548c2efee9c5fdfd8ae62179d2c1169685a840b70d19714d68cd793872b77f9c361657bac0b714594aa9c2a5271921306101f9d2a60bc61cb29b579336
-
C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log.redeem.[[email protected]][MJ-UK8039276154].lambda
Filesize130KB
MD59fb8e92cdffff8e4b5e2d14d69319cd4
SHA161483b79f9abdc640409b236cdbbb07c1e5580ec
SHA25672a13bdaaec68f0ea196e9ce4e87d7cd3b7026d9e1efe43de1b2318d016c5bfe
SHA5126303936dfddbe42d4aea4e6a5f6b3abf37710b198dce4a9508a0f287d29bdb96a55adbc7cf1b8514c0b7465240ad98c512cd423c0a6f7667232aa93d92fe83f3
-
C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log.redeem.[[email protected]][MJ-UK8039276154].lambda
Filesize124KB
MD5497ce5b608867e08a6484357cad43011
SHA1330a08feea695595bb75c45c3f8c8b98f012c218
SHA256602b1b048e3f24eed75ac4012835bfbeb9c19a30b384f0774fddd690b20122bc
SHA512158449672e5fd6c1ffc69614e4fc9cbb7988895329705ac659f4a39a58abb26a4b47c987366ecf49708ab3d6f65d1fb7499ff34121510ffaa141a4746e99efe5
-
C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log.redeem.[[email protected]][MJ-UK8039276154].lambda
Filesize136KB
MD50df00854060f1e155872f8113b493253
SHA116d9731984a59e0a193556a63191cd0f60a8cfae
SHA2565cbe3c2c87f99eddebc5ca0c96fc230eb914036348bee6f8eda5c099ea95e45a
SHA51228fdb692a7579176ff0eb1f385aa4b41602daae6a9059e78dbcc553bf9185f4a3c612f487cf51baf7fe99f3a7a6c55d5a13e8002a5e62c4183dfd8c2b34a75f4
-
Filesize
145B
MD5ca13857b2fd3895a39f09d9dde3cca97
SHA18b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA51255e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
-
Filesize
8KB
MD57605e69eb825f91b53b617d3560794f9
SHA105834aa5ca4c4459b9ffb9f4f2827dc50181a48f
SHA25630aa71789cdba1395de5f1c0e38ab2c225e496172dc6d1a8d5547b2fbedbfa19
SHA512fe5e535fe7c3728b714c83659f61aa8878edd0c8b935beb56e0a425ca4f62db8e08593011e031d6e046075c10424458a8745ddffe41f64786fe0beb27a7d6edc
-
F:\Depkominfo_Didefaced.htm.redeem.cuba.[[email protected]][MJ-UK8039276154].lambda
Filesize9KB
MD58c1a1d4b22336b87e3b252ef18ab88da
SHA1fad4c117614ea3eb5b06d2de63e59ef2aa1617b9
SHA256ead61cfd5091115184286e2e4670af1f8eeae54b20edd51cc94cfe20d7368d08
SHA512372eeaf357e9f107d8a2cd635c42015564282b1b96f490f38d25d9b2282448843cfc782e19c67e35d7f993e7baf88bfc2bd75595baa44131a8e3875200ad898e
-
Filesize
680B
MD589922235ddb62c37c3fe46111b53d256
SHA182eea022bf46b25d6e51e5278237f11c77a0adaf
SHA256d440f202373b5cfaef07dbf982f3e034c79159c7839805328e6a07f702f6507f
SHA512e367a5b4440a800eb733f503fbdb158785111cf86e3f2b7c656290a902c6dee58c6a62f9251bae7730f69632034ffcb0c5b167120a9f51025dfd13adb65d1e44
-
F:\Program Files\PDF_Reader\PDF_Reader.exe.[[email protected]][MJ-UK8039276154].lambda
Filesize215KB
MD55ae1d996b1bd05f5a2073dda235c2be4
SHA1a35293873b9189e829f7a75d0b6828a20e703513
SHA25658ee81be20719759b65887e0e6c17c2d9136219267ed82cd83bd4eba79c372b3
SHA512a1106925976e292d175d5ca2671fa27c1bd2efd3b59a883ec4ab76d142ba2c97515d634442e548f05834d30fcb913e09115ef872725267067f8289778ad0bba4
-
Filesize
381B
MD527fc937830aba762026cbd58a67b555f
SHA169ada2ba80a6c1a56721f44f4049942d5d5a5d08
SHA2566270b211fce6dd684b04c7036cdd758ca7ca760c101d1c7811a659fa16d54e8b
SHA51266a3900d73233147cc0022458d5dd863df02eea276055005534f6751c664b2262a9ad29c3068044efc6e550d9c939f7d1ba16ad6d731e37c28fcc2cec291663e