Analysis
-
max time kernel
108s -
max time network
302s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
25-09-2024 20:27
General
-
Target
RNSM00472.7z
-
Size
46.1MB
-
MD5
e71a3dbd999bf53c3c820819fce516d1
-
SHA1
d7d0ea53cc45f81bd4efa0fe8c4bf0c1ade096aa
-
SHA256
e54915db3dea53ce4044e5f7e0ae8c8f010dc1f62cc8b09054ed01f79e559ab3
-
SHA512
bb9159041b28bd87203244e4d1bca7b62f76f43e0e107c50230c02aecf00c688ecde0814622070c68655a25eabf4566ee02ed7c2e62c4f425139c8b248f494f6
-
SSDEEP
786432:joDk3ebC2AfOlxjhalhB8MFk70E8U9oTSq96Mbp69PHhX624TkIjwFTRCyQ:juyebCvOLgKKg0w9EPkPBX65TkIM7CyQ
Malware Config
Extracted
C:\Program Files\Crashpad\HOW TO RESTORE YOUR FILES.TXT
https://tox.chat/
Extracted
redline
ANYTHING U WANT
3.235.181.77:80
Extracted
nanocore
1.2.2.0
darkrig.ddns.net:54984
127.0.0.1:54984
a4e9a3b2-293f-477b-9774-458e8f942810
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2018-09-09T20:42:26.979636536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
54984
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
a4e9a3b2-293f-477b-9774-458e8f942810
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
darkrig.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
njrat
0.6.4
By Dz
fathiyassin22.ddns.net:1177
d5a38e9b5f206c41f8851bf04a251d26
-
reg_key
d5a38e9b5f206c41f8851bf04a251d26
-
splitter
|'|'|
Extracted
njrat
0.7d
Run RunPE
-
splitter
|'|'|
Extracted
urelas
1.234.83.146
133.242.129.155
218.54.31.226
218.54.30.235
218.54.31.165
112.175.88.207
112.175.88.208
Extracted
C:\Users\Public\how_to_back_files.html
Extracted
C:\info.hta
class='mark'>[email protected]</span></div>
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Detecting the common Go functions and variables names used by Snatch ransomware 9 IoCs
-
GandCrab payload 3 IoCs
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 1 IoCs
-
Snatch Ransomware
Ransomware family generally distributed through RDP bruteforce attacks.
-
Urelas
Urelas is a trojan targeting card games.
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
-
Renames multiple (69) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (71) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 5 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 3 IoCs
-
Executes dropped EXE 27 IoCs
-
Loads dropped DLL 5 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 3 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 3 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
UPX packed file 33 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 64 IoCs
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Program crash 7 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 26 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies registry class 2 IoCs
-
Runs .reg file with regedit 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookAW 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\RNSM00472.7z1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00472.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.MSIL.Blocker.gen-097c62c749f1117c1770609807183f461c1073af5e4e0f385335373d90033461.exeHEUR-Trojan-Ransom.MSIL.Blocker.gen-097c62c749f1117c1770609807183f461c1073af5e4e0f385335373d90033461.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.MSIL.Encoder.gen-0a15523dea074c077b408cc2dfde2d769f0c90a9a70bfe1c311cd109769a414d.exeHEUR-Trojan-Ransom.MSIL.Encoder.gen-0a15523dea074c077b408cc2dfde2d769f0c90a9a70bfe1c311cd109769a414d.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\eowp.20.2.90.0.exe"C:\Users\Admin\AppData\Local\Temp\eowp.20.2.90.0.exe" --eoim --eo_init_data=eo.ipc.temp.20.2.90.0.3572.1.24⤵
-
C:\Users\Admin\AppData\Local\Temp\eowp.20.2.90.0.exe"C:\Users\Admin\AppData\Local\Temp\eowp.20.2.90.0.exe" --enable-speech-input --auto-scan-plugin --enable-media-stream --no-sandbox --disable-gpu --eo_init_data=eo.ipc.temp.20.2.90.0.3572.1.54⤵
-
C:\Users\Admin\AppData\Local\Temp\eowp.20.2.90.0.exe"C:\Users\Admin\AppData\Local\Temp\eowp.20.2.90.0.exe" --type=gpu-process --field-trial-handle=1688,6651872245946923366,11070979626738871503,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=1692 /prefetch:2 --eo_init_data=eo.temp.7400.15⤵
-
C:\Users\Admin\AppData\Local\Temp\eowp.20.2.90.0.exe"C:\Users\Admin\AppData\Local\Temp\eowp.20.2.90.0.exe" --type=utility --field-trial-handle=1688,6651872245946923366,11070979626738871503,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2112 /prefetch:8 --eo_init_data=eo.temp.7400.35⤵
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.Blocker.pef-16107ff165ea1583453c4601382e8ffa94c165eed719528ba39b9e1517d91522.exeHEUR-Trojan-Ransom.Win32.Blocker.pef-16107ff165ea1583453c4601382e8ffa94c165eed719528ba39b9e1517d91522.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-21d02500d4112571a166bba52766140de90b58792e7b1a19741fe3e4c819ffaa.exeHEUR-Trojan-Ransom.Win32.Crypmodadv.vho-21d02500d4112571a166bba52766140de90b58792e7b1a19741fe3e4c819ffaa.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.Cryptoff.vho-3c125e17c7fcedbe58f24645457f392d82354e9be0986d99ee9654c8c9b4e28a.exeHEUR-Trojan-Ransom.Win32.Cryptoff.vho-3c125e17c7fcedbe58f24645457f392d82354e9be0986d99ee9654c8c9b4e28a.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.Encoder.gen-fd9bf3cdb00dc14a3d673942136237ea533cd6146db7efd334e667bc6206e8c7.exeHEUR-Trojan-Ransom.Win32.Encoder.gen-fd9bf3cdb00dc14a3d673942136237ea533cd6146db7efd334e667bc6206e8c7.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\TTL.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\TTL.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-5aff02b30f771b46c66d3b7d6ff42aff48a6584c0d0a012856758d1eb6cfeb09.exeHEUR-Trojan-Ransom.Win32.GandCrypt.gen-5aff02b30f771b46c66d3b7d6ff42aff48a6584c0d0a012856758d1eb6cfeb09.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookAW
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 4804⤵
- Program crash
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.Gen.gen-92e00259ce381ad31f02a0a8c14d617abb27befa8875c19e4a380b7b580ff825.exeHEUR-Trojan-Ransom.Win32.Gen.gen-92e00259ce381ad31f02a0a8c14d617abb27befa8875c19e4a380b7b580ff825.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.Generic-f4294944ad82c2c9e0cf9cfb31461bfaa97741fd35d4eb11068fad722e93d8cc.exeHEUR-Trojan-Ransom.Win32.Generic-f4294944ad82c2c9e0cf9cfb31461bfaa97741fd35d4eb11068fad722e93d8cc.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\Desktop\00472\jhsaebey.bat4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exeSC QUERY5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\findstr.exeFINDSTR SERVICE_NAME5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\Desktop\00472\eapejfnqytiyspo.bat4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.Phobos.vho-a4c7517fe4548f71f2f2e6848100d638c3bd7d03fa225ca598a03824b7575fd1.exeHEUR-Trojan-Ransom.Win32.Phobos.vho-a4c7517fe4548f71f2f2e6848100d638c3bd7d03fa225ca598a03824b7575fd1.exe3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.Phobos.vho-a4c7517fe4548f71f2f2e6848100d638c3bd7d03fa225ca598a03824b7575fd1.exe"C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.Phobos.vho-a4c7517fe4548f71f2f2e6848100d638c3bd7d03fa225ca598a03824b7575fd1.exe"4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet5⤵
- Deletes backup catalog
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}4⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}4⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}4⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete5⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet5⤵
- Deletes backup catalog
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-288506a5e91bce7b6d67f164ceca2043981e2c0ffb57b1c9f43080df87ba54ea.exeHEUR-Trojan-Ransom.Win32.PolyRansom.gen-288506a5e91bce7b6d67f164ceca2043981e2c0ffb57b1c9f43080df87ba54ea.exe3⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-0cf2980957b6cac5bcd07053ddfc75774d142d64742e079e15cbe31fbf0c73db.exeHEUR-Trojan.MSIL.Crypt.gen-0cf2980957b6cac5bcd07053ddfc75774d142d64742e079e15cbe31fbf0c73db.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-1b11e0d978a65022cff640180ab755b1ead1446bc159b3423a71447c8d82b8e7.exeHEUR-Trojan.MSIL.Crypt.gen-1b11e0d978a65022cff640180ab755b1ead1446bc159b3423a71447c8d82b8e7.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-1b11e0d978a65022cff640180ab755b1ead1446bc159b3423a71447c8d82b8e7.exeC:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-1b11e0d978a65022cff640180ab755b1ead1446bc159b3423a71447c8d82b8e7.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-2a2a395a08cc6f189d1183d626573791f7d430ac832f4360bf7c69d0b1a4fd87.exeHEUR-Trojan.MSIL.Crypt.gen-2a2a395a08cc6f189d1183d626573791f7d430ac832f4360bf7c69d0b1a4fd87.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-3057f39e4f208f2230aec594a24d232021d156b0b1fee804791b483e3fb09b63.exeHEUR-Trojan.MSIL.Crypt.gen-3057f39e4f208f2230aec594a24d232021d156b0b1fee804791b483e3fb09b63.exe3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-3057f39e4f208f2230aec594a24d232021d156b0b1fee804791b483e3fb09b63.exe"C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-3057f39e4f208f2230aec594a24d232021d156b0b1fee804791b483e3fb09b63.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-5a6197a5416871d717d8341783a2fe48ef51196c36889ce9aed77d09a3bbcb49.exeHEUR-Trojan.MSIL.Crypt.gen-5a6197a5416871d717d8341783a2fe48ef51196c36889ce9aed77d09a3bbcb49.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\explorer.exe"C:\Users\Admin\AppData\Local\Temp\explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "explorer.exe" ENABLE5⤵
- Modifies Windows Firewall
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-5c0d4d84e872c0db72e2e794984be910479e96a8362df575902d73cc3d563f47.exeHEUR-Trojan.MSIL.Crypt.gen-5c0d4d84e872c0db72e2e794984be910479e96a8362df575902d73cc3d563f47.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE5⤵
- Modifies Windows Firewall
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-69351c390cafecd46850d99d14865b38bd7011ad6cb909c4cffbc3a26c30edc7.exeHEUR-Trojan.MSIL.Crypt.gen-69351c390cafecd46850d99d14865b38bd7011ad6cb909c4cffbc3a26c30edc7.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\conhost.exe"C:\ProgramData\conhost.exe"4⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\ProgramData\conhost.exe" "conhost.exe" ENABLE5⤵
- Modifies Windows Firewall
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-6b6677b2f03bf0d42555d088ab5998d8e5766f187b2fdc50d019132a022508fe.exeHEUR-Trojan.MSIL.Crypt.gen-6b6677b2f03bf0d42555d088ab5998d8e5766f187b2fdc50d019132a022508fe.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6024 -s 17604⤵
- Program crash
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-9b9a1e80fbba62a19279355263357e19985ae87022143a775a4a7c4423f1a018.exeHEUR-Trojan.MSIL.Crypt.gen-9b9a1e80fbba62a19279355263357e19985ae87022143a775a4a7c4423f1a018.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\WindowsService.exe"C:\Users\Admin\AppData\Local\Temp\WindowsService.exe"4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /mo 1 /tn OneDrive Standalone Update Task-S-2-2-21-A34399025-2357474525-3480111942-1A01 /tr C:\Users\Admin\AppData\Local\Temp/oneDrive.exe5⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-a359ed4c718443e4d0eedf547053e60e0cead40b60abcc7507b94cd9503798b4.exeHEUR-Trojan.MSIL.Crypt.gen-a359ed4c718443e4d0eedf547053e60e0cead40b60abcc7507b94cd9503798b4.exe3⤵
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-bf99a65ec277081f265d0580c2960d460a9878182bc4920b6e37a11d32356b1a.exeHEUR-Trojan.MSIL.Crypt.gen-bf99a65ec277081f265d0580c2960d460a9878182bc4920b6e37a11d32356b1a.exe3⤵
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-bf99a65ec277081f265d0580c2960d460a9878182bc4920b6e37a11d32356b1a.exeC:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-bf99a65ec277081f265d0580c2960d460a9878182bc4920b6e37a11d32356b1a.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\chrome.exe"C:\Users\Admin\AppData\Local\Temp\chrome.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\chrome.exeC:\Users\Admin\AppData\Local\Temp\chrome.exe6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6352 -s 807⤵
- Program crash
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-e1786f65d2e65f3d5d64b74b543da48cca584b9a34021ead9fefdcfb450a3cb1.exeHEUR-Trojan.MSIL.Crypt.gen-e1786f65d2e65f3d5d64b74b543da48cca584b9a34021ead9fefdcfb450a3cb1.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8764⤵
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-f8fb88c9549241fbf29c933609eaa1936ba89b6cd5cbd94ca4ef3b200e6cf6c9.exeHEUR-Trojan.MSIL.Crypt.gen-f8fb88c9549241fbf29c933609eaa1936ba89b6cd5cbd94ca4ef3b200e6cf6c9.exe3⤵
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Cryptos.gen-b61b2a462518f4c2a8a1fe876f0339b714c4d7153bb559751e3afbfd610aefb4.exeHEUR-Trojan.MSIL.Cryptos.gen-b61b2a462518f4c2a8a1fe876f0339b714c4d7153bb559751e3afbfd610aefb4.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.Blocker.ikdo-521a5fefffa577037d30c73264f1a00bd94ee34236063d08633e9f83026fcf02.exeTrojan-Ransom.Win32.Blocker.ikdo-521a5fefffa577037d30c73264f1a00bd94ee34236063d08633e9f83026fcf02.exe3⤵
-
C:\Windows\SysWOW64\cmd.execmd /k del "C:\Arquivos de programas\GbPlugin\." /q4⤵
-
C:\Windows\SysWOW64\cmd.execmd /k rd "%ProgramFiles%\GbPlugin"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /k del "C:\Program Files (x86)\GbPlugin\." /q4⤵
-
C:\Windows\SysWOW64\cmd.execmd /k rd "C:\Program Files (x86)\GbPlugin"4⤵
-
C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.Blocker.jxhc-d903a265d9329c16e11945a70a30cb44d7b8cfbf8db9adef78adef0000b213ed.exeTrojan-Ransom.Win32.Blocker.jxhc-d903a265d9329c16e11945a70a30cb44d7b8cfbf8db9adef78adef0000b213ed.exe3⤵
-
C:\Users\Admin\AppData\Roaming\L o c k e r.exe"C:\Users\Admin\AppData\Roaming\L o c k e r.exe"4⤵
-
C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.Blocker.leeg-ba0fc4fe4c3828df427dd14d246e72887a64ddf79f7064b907157e3219f6d03f.exeTrojan-Ransom.Win32.Blocker.leeg-ba0fc4fe4c3828df427dd14d246e72887a64ddf79f7064b907157e3219f6d03f.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FSINST~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FSINST~1.EXE4⤵
-
C:\Users\Admin\AppData\Roaming\fsstarter.exe"C:\Users\Admin\AppData\Roaming\fsstarter.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\Tor\Tor\tor.exe"C:\Users\Admin\AppData\Roaming\Tor\Tor\tor.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7804 -s 22406⤵
- Program crash
-
C:\Windows\SysWOW64\regedit.exe"regedit.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Off.reg"5⤵
- Runs .reg file with regedit
-
C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.Blocker.nbxn-f8243914c556ce022301fb790f7513d90321f60b0f4d84abe9fdf6a782c4fd4b.exeTrojan-Ransom.Win32.Blocker.nbxn-f8243914c556ce022301fb790f7513d90321f60b0f4d84abe9fdf6a782c4fd4b.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6420 -s 4084⤵
- Program crash
-
C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.Cryptodef.aoo-1b6af8d8076c7e2dd5c735700538ba50888ed9046b89937ef31d9fe973eabb8c.exeTrojan-Ransom.Win32.Cryptodef.aoo-1b6af8d8076c7e2dd5c735700538ba50888ed9046b89937ef31d9fe973eabb8c.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\wujek.exe"C:\Users\Admin\AppData\Local\Temp\wujek.exe"4⤵
-
C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.Encoder.nvh-5924939a99271eeab67e7fe7ec31efb33ba2997170546483349f4a6ca8587088.exeTrojan-Ransom.Win32.Encoder.nvh-5924939a99271eeab67e7fe7ec31efb33ba2997170546483349f4a6ca8587088.exe3⤵
-
C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.Encoder.ool-fd4888ffa8d889244cdebe21e92ecce7fbe45558cdf3db619fd2c76b67d04a01.exeTrojan-Ransom.Win32.Encoder.ool-fd4888ffa8d889244cdebe21e92ecce7fbe45558cdf3db619fd2c76b67d04a01.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start https://discord.gg/9jBfMmEAPz4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/9jBfMmEAPz5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff2a9646f8,0x7fff2a964708,0x7fff2a9647186⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\TEMP\206F3FDC-B1A8-4FD6-BDB8-6CFE76122873",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\ProgramData\Microsoft\Windows\WER\Temp\WER95DF.tmp.mdmp",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows.old\Users\All Users\Microsoft\Windows\WER\Temp\WER95DF.tmp.mdmp",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\All Users\Microsoft\Windows\WER\Temp\WER95DF.tmp.mdmp",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\CbsTemp\30780525_1668355464",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\TEMP\6E04EF32-0387-48B1-B812-AC2BBA90A8D0",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cookies",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\%username%\AppData\Local\NVIDIA Corporation\GfeSDK\FORTNI~1.LOG",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\CMS\Files\9A71EB4A90946A4A0DCD9B7D82F48C55B49D0880\siphon-1024x512-4cc0ff3407053325e353c4aea55fb30316e6ecf6.jpg",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\CMS\Files\9A71EB4A90946A4A0DCD9B7D82F48C55B49D0880\Fortnite%2Ffortnite-game%2Ftournaments%2F11BR_Arena_ModeTiles_Squad_ModeTile-1024x512-c543a187ce733be5ee9f6d17bfb74fb1f2e15f4a.jpg",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\CMS\Files\9A71EB4A90946A4A0DCD9B7D82F48C55B49D0880\Fortnite%2Ffortnite-game%2Ftournaments%2F11BR_Arena_ModeTiles_Solo_ModeTile-1024x512-6cee09d7bcf82ce3f32ca7c77ca04948121ce617.jpg",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\V0100024.log",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\All Users\Microsoft\Windows\WER\Temp\WER5CC2.tmp.xml",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows.old\Users\All Users\Microsoft\Windows\WER\Temp\WER6D21.tmp.WERInternalMetadata.xml",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\%username%\AppData\Local\Temp\ecache.bin",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\%username%\AppData\Local\CrashDumps\BACKGR~2.DMP",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\prefetch\ATTRIB.EXE-58A07CAF.pf",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\prefetch\AgRobust.db",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\%username%\AppData\Local\Microsoft\Feeds Cache",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\prefetch\CEPHTMLENGINE.EXE-E15640BA.pf",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\prefetch\CMD.EXE-0BD30981.pf",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\prefetch\CLIPUP.EXE-4C5C7B66.pf",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\prefetch\D3D9TEST.EXE-1B86F3FC.pf",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\prefetch\DISCORD.EXE-6BEBC47C.pf",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\prefetch\EPICGAMESLAUNCHER.EXE-FAB85FF0.pf",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\prefetch\EPICGAMESLAUNCHER.EXE-018FC121.pf",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\prefetch\GET-GRAPHICS-OFFSETS64.EXE-2BCB2EA4.pf",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\prefetch\GET-GRAPHICS-OFFSETS32.EXE-D4C865E3.pf",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\prefetch\OBS64.EXE-2B6570C7.pf",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\prefetch\OBS-FFMPEG-MUX.EXE-1C01271A.pf",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\prefetch\OBS-FFMPEG-MUX.EXE-1C01271A.pf",4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cd C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cd D:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cd E:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cd F:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del /f /s /q "C:\Users\%username%\Desktop\test\*.*"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c @del /s /f /a:h /a:a /q "C:\Users\All Users\NVIDIA\*.*"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c @del /s /f /a:h /a:a /q "C:\ProgramData\NVIDIA\*.*"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c @del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\*.*"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c @del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\*.*"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c @del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\*.*"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c @del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\FortniteGame\Saved\Demos\*.*"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c @del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Recent\*.*"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c @del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Google\Chrome\User Data\lockfile"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c @del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Google\Chrome\User Data\BrowserMetrics\*.*"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c @del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\*.*"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c @del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\*.*"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c @del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Google\Chrome\User Data\Default\*.*"4⤵
-
C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.GandCrypt.afy-aeebbd559d253486f894a31798b3195515c83cafd4fe13162f57a60e850c120b.exeTrojan-Ransom.Win32.GandCrypt.afy-aeebbd559d253486f894a31798b3195515c83cafd4fe13162f57a60e850c120b.exe3⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru4⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru4⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru4⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru4⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru4⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru4⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru4⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru4⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru4⤵
-
C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.GandCrypt.jfg-64a9db0f5f3597eb24bec5af89f1ac5847991050a5282d06e5260a6cefc1d8d0.exeTrojan-Ransom.Win32.GandCrypt.jfg-64a9db0f5f3597eb24bec5af89f1ac5847991050a5282d06e5260a6cefc1d8d0.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 4604⤵
- Program crash
-
C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.GandCrypt.oc-7dfc4b1165f674c02f57b11f2a4fb33e866d527968a0b8e54b9590e1041df84b.exeTrojan-Ransom.Win32.GandCrypt.oc-7dfc4b1165f674c02f57b11f2a4fb33e866d527968a0b8e54b9590e1041df84b.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6936 -s 4764⤵
- Program crash
-
C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.GenericCryptor.cys-d122b7e2f7119e3f0d7b8cad0c12de0bac66db665e4dccc6367fe6674c1d1a69.exeTrojan-Ransom.Win32.GenericCryptor.cys-d122b7e2f7119e3f0d7b8cad0c12de0bac66db665e4dccc6367fe6674c1d1a69.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\lydip.exe"C:\Users\Admin\AppData\Local\Temp\lydip.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "4⤵
-
C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.GenericCryptor.czo-4a314e3e89f22c770b419030bbc0b0914b74ae568da4159ee83fe32259d69ddd.exeTrojan-Ransom.Win32.GenericCryptor.czo-4a314e3e89f22c770b419030bbc0b0914b74ae568da4159ee83fe32259d69ddd.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\lydip.exe"C:\Users\Admin\AppData\Local\Temp\lydip.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\huter.exe"C:\Users\Admin\AppData\Local\Temp\huter.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "4⤵
-
C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.GenericCryptor.czx-a7cdb5a8c4249c1722090a6887a5c7d6a37532b98aae78af2e893fa1ddbc5176.exeTrojan-Ransom.Win32.GenericCryptor.czx-a7cdb5a8c4249c1722090a6887a5c7d6a37532b98aae78af2e893fa1ddbc5176.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\lydip.exe"C:\Users\Admin\AppData\Local\Temp\lydip.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "4⤵
-
C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.Gimemo.cdqu-59593f9ead4b9632a9af16a18612f9819bc07d69afe00b34858b37bfa16b89cc.exeTrojan-Ransom.Win32.Gimemo.cdqu-59593f9ead4b9632a9af16a18612f9819bc07d69afe00b34858b37bfa16b89cc.exe3⤵
-
C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.Purgen.apt-de261738cfd2ad127ea3eaaa13c825abf2ac5a39a4f9fb5353e16d59c34659b4.exeTrojan-Ransom.Win32.Purgen.apt-de261738cfd2ad127ea3eaaa13c825abf2ac5a39a4f9fb5353e16d59c34659b4.exe3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.Purgen.apt-de261738cfd2ad127ea3eaaa13c825abf2ac5a39a4f9fb5353e16d59c34659b4.exe > nul4⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /12⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4784 -ip 47841⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 6352 -ip 63521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6420 -ip 64201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6024 -ip 60241⤵
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 6540 -ip 65401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7804 -ip 78041⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\7d76be9f5315473088cdaeae38fbb92f /t 5708 /p 73121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 6936 -ip 69361⤵
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\85e5972bb27f40ff8cfd89483f47ea09 /t 3784 /p 35721⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.Gimemo.cdqu-59593f9ead4b9632a9af16a18612f9819bc07d69afe00b34858b37bfa16b89cc.exe"C:\Users\Admin\Desktop\00472\Trojan-Ransom.Win32.Gimemo.cdqu-59593f9ead4b9632a9af16a18612f9819bc07d69afe00b34858b37bfa16b89cc.exe"2⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\3f3badf32c0c4f3da7b9b6189f80a419 /t 6276 /p 43681⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
4File Deletion
4Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\7-zip.chmFilesize
1.8MB
MD5222c204f02e6099b569f336602c44501
SHA12c31ec7c6a42b1fbffda1ea3efbefa9028899e1e
SHA256963f66d7ea67d5e480592f8b9b337900a13202a68cfb8d899a3a0fc8597e51c2
SHA51254e771b88ece12cbfdc6aea18ecb92bb775f987c31e8edf1fb70016ea365b5ec79b28d86867dd45c410b14ae4671ec3c5076e2ab5aeebc48e414e64ace8bf18f
-
C:\Program Files\7-Zip\7-zip.chm.exeFilesize
1.8MB
MD570b09595215f067452c46eb61f3745fd
SHA198a46fc9b19a2859492f22a548cfacf72ef6231e
SHA256545d083f985ca8c3d3629e8dcf3195ff7ba005700002429229f0ee2f9134caff
SHA5129a14d7b1a751d5386df5a025f54b1e1b6478906aca2a5268b1c6120ab8355160d7344703dc93dc402de465ac4476bdfae946fbf7f3d52b534c71474f4d29e551
-
C:\Program Files\7-Zip\7-zip.dll.exeFilesize
1.8MB
MD53de89eb715880921ef59bc133e6b419a
SHA199b8f08340602782817d8b77ac445c60c71980ed
SHA2567d79f1784d8f021f4dc4e2d8fc71a20f5ceb811de25a5fea250a15249c803f6d
SHA5127b17920fe7d7dec7e0ac68b37b2a81f4d1c91f3459fdda2b10f1104dfe6f871683b455c5cb8f37401b082647de6f30152fced17a42c7a11bcacb2ef2a381e336
-
C:\Program Files\7-Zip\7-zip.dll.exe.id[54A67FCC-2930].[[email protected]].ekingFilesize
2.5MB
MD505f5b3de6921215967ae9f5eb8564d32
SHA17b1adfb79ed353860a94561b6d432ed7193aaf5f
SHA256043de73c3c3ec38608f6e15479b260332c723243178e9731ff2644325ef23c93
SHA5124e4774d9fd8ea74501cf6a2521940395c030939e89ce4709990d48ed45a7ea717ea1893f89e88fd32e284030199c54320b6433ff47362f8b443d2bf1f4ea504c
-
C:\Program Files\7-Zip\7-zip32.dllFilesize
1.8MB
MD593b3733b1fc1f420b6b242703b768725
SHA10e0bfea397cb83e3546456f4938f54f6ff60b2a2
SHA256f5ca2c8ea8deae57c72fc3d6d1c34579ff0142d373d85a83268cfbb381f17cd3
SHA512c03145be8211fa5a5591a3359b8711b50a5e4ed05bf34ae6db1eadbd6d9eafa238801c168a7d7ed4b33091bd0c547faee52f5b48329584ad1fb24234c01c1b44
-
C:\Program Files\7-Zip\7-zip32.dll.exeFilesize
1.8MB
MD54f1e5ceb8c052700e0c4b3081aa33b41
SHA1c24bf038572e877cf804872aef098924d41e4f47
SHA256572d169a441544508d923229540d08f70e730f5ff08478f82e660b2394662011
SHA512c7d069caaed244fc6a390208ee5d0c51f425ce19cf30d136deb109b838f4cb871131513e1992ec7f853890fe659151293592a387d68fcd5576e8694651a3c4c4
-
C:\Program Files\7-Zip\7z.dllFilesize
1.8MB
MD5d256d87d98f4384dc66b19ee6c061240
SHA1ac71ddccd936469802cc40e5ace013c9dfbc0f8a
SHA256419f46f1bf995012f2cadbc56b8d578a8f56954a9c271c7f5d66b94844d8bcb7
SHA5125df438ad0c353a2ca89efcd3f34aa8d8d85d569ad318bed439ccfdf4bdfb691294cb26cf226cb0b56396f159561a0aeb3a30648c846923d23a54ed296b05e7aa
-
C:\Program Files\7-Zip\7z.dll.exeFilesize
1.8MB
MD5a856d01b679afeac51c00d972e24fcfe
SHA1e8b4b8d7594ecac977a102cce6abc4dc4d4ef0ae
SHA2564b344182d1e3bddb3b3acff8e682417ae989ff49d088ddd5e2b5d3af564ac3c0
SHA51267cbcb466c2cda2c314a62b3555b8a47f1516cb22a52c459bee19540a52d1bb0700ca68df0b78847040dfd9d376fc1df6a3147946b5da94cff57ee8915f8db55
-
C:\Program Files\7-Zip\7z.exeFilesize
2.5MB
MD5583329e65ca3fb31f188cf16f76dcdbd
SHA18a71e61e015a6c66c36b6c368a87de0b6e5a03b6
SHA256ab57d50624fa271eafcfaa7d33e51b6124b1dc3a2ed1a754b05446dfd7282b67
SHA51292935bc0fe64e8fcd05629020a60c932e1113c0275fdd7267ef60f123c508695eefaafda0ef82c94e4c18a39bc8a9bf96c429434a8684c06c24aec29b5a64ee3
-
C:\Program Files\7-Zip\7z.exe.exeFilesize
2.5MB
MD57de28782ffdd579bbbf9b285b81a0704
SHA1d0de00bda34e1bd1a9873cf1047a5460d3030093
SHA25684a018ab19c0fb6487e35367421eb66d311863a7624494e861501062b79bf5a4
SHA512e286a0b5bc4f561546aef615589fc94ea735f37bf361e164109abfb5892ea2ad463d3afeae128af7b163c7f9eaaa820cf4daad392d6d6a2aa7354fe5ac72b46f
-
C:\Program Files\7-Zip\7z.sfxFilesize
2.5MB
MD5c6126e44718e957dca0538b3dc906e1c
SHA134d9639060cc140e9259f9025571bb59978306c3
SHA25617bd419448fdddbff8631c6c1cd0954b55fb22583ab25d1c5bd09d0ae50c2e3c
SHA512d4a06133133405f2867d69add70f85bd5434bceb9367fa60c3356ff4424d915de001d380a28044a000c944c7d4375a95ae305bb1bd6f2ccd4da15ba896d75769
-
C:\Program Files\7-Zip\7z.sfx.exeFilesize
2.5MB
MD5f497001dcd0a978a7eab9ff64b4627f0
SHA1409206080cc6f79a7693c6fadefd698f74d10dcf
SHA2564a3da6748411444c5a57909e881b2c7de5a4cb4400554e175476ba20aecef458
SHA512324e02e900b3740b837b33fbc52372ed0151d343abe61dc0d5473d5b1db128160e8793d64aabc4878209f9773c6987a6ec355bb6ef79db2078f701d35a86adaf
-
C:\Program Files\7-Zip\7zCon.sfxFilesize
2.5MB
MD5ca867706211853f7a447c7dc07c7098f
SHA1ed1b0244053963d35b68c4bea2252ba75b8cd403
SHA256759ff003f5e44423a116abc257d62c6e70532382df59c789140fa99de9e150e9
SHA5125d1b0e655f65718d7724af3467efd8ee6a22a7ea460e3aff2baec799d8902ff2f1a6c81ac5982c99ecc90345cfe3c7c1b45e97690707bcfc03ccc15d99213fa0
-
C:\Program Files\7-Zip\7zCon.sfx.exeFilesize
1.8MB
MD576c64fe7d47592ad1dc87c530d6084ca
SHA16dfa1b0e149c169cc3a2facd4709dc318901428e
SHA2569fbec103b86a85c57e3602338ee95789e9dc06c2f1deb1dc232bbfb09618845b
SHA512c1ff85be349a7f3b5a880d7f93baba65f23a9395492239e61c51e1a4b75eb368e4a696332b7666c9cde507b07cbacdee8e7c0f9c5f9edeb9fa8a2395a444a323
-
C:\Program Files\7-Zip\7zFM.exeFilesize
1.8MB
MD524c7389842b94028286deb02c955e7ff
SHA1eb557723bc571ec92f87d9f03775fe66ea7864b1
SHA2566de46e0ca46524020e16b4f05c3e0109def4a59c40b999a2263e8369813a2531
SHA512fc3e4d680fe61224b3a4adbc329b1fb24ffe3ac058f7ecd9d066400ff40cf3e4fcf3ec938215a39673c82a73019a4d20a59892b37fb0e8eabcf7969e12f7f1e3
-
C:\Program Files\7-Zip\7zFM.exe.exeFilesize
2.5MB
MD5f376ab807694d94bd3c079dd04d1b0c9
SHA1727672434dcd5ba508c039241d7124df9438b0b4
SHA256e25945252cf36693d9a004d6272d1b90272b66e4d97bfa705489a033d8c163a8
SHA512939cfde17f766b60b2bd4b367826281f71f83f1381ab842fed4c65cd62759b7754d284fcf8d44a9b955fe7211230036ebd9b6bb64e83d3965f0a041602fa4c50
-
C:\Program Files\Crashpad\HOW TO RESTORE YOUR FILES.TXTFilesize
1KB
MD53c4d5b327b5937a2ab86f99bc6031acd
SHA113a12d50c0cbc1c5b9958ed4e78b1f8b607a9921
SHA256d230d720db9257b5aebda6ec57dde580879b8c9a6a60a34d0ee66b57a8e727bd
SHA51270fa42af2d49c82af99525907998e071143653553f86783b57a8659b9302d58288993dab8a45ddd5b6ef8baf020aab0150ef825449ef36902083638bc0baa007
-
C:\ProgramData\conhost.exeFilesize
473KB
MD54cf8683f2338e1a60b56524c8955b607
SHA13e93493de2a817aa04ba3fe335c4c2fc35978ccd
SHA25669351c390cafecd46850d99d14865b38bd7011ad6cb909c4cffbc3a26c30edc7
SHA512f08c1aa3c13f2bc9c13fd8173f27e2e3b957cb4f81f98258d8bbde001d4eb70242be37e50d1f5fabb41fb735be5c2cd7bc8a6655ac54c28a5858fdcf89bee404
-
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idxFilesize
64KB
MD5d2fb266b97caff2086bf0fa74eddb6b2
SHA12f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA256b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
SHA512c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
-
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lockFilesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.valFilesize
944B
MD56bd369f7c74a28194c991ed1404da30f
SHA10f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA256878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
SHA5128fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HEUR-Trojan.MSIL.Crypt.gen-1b11e0d978a65022cff640180ab755b1ead1446bc159b3423a71447c8d82b8e7.exe.logFilesize
418B
MD52f51ee33b74ab710e289b65a7b580c9b
SHA1031f919473e89c4a463360c7a898fda986836470
SHA256bdb480893a7d1acc95b67f49dd12a0c1f69b75d1908536d0cc1350ebfbb5cc58
SHA512927bd82da2cc751b6b2c97efc33019b8977f2d78d467b363cf609e27a3ac8986e0b4c3b4d025be9fe87f50db51285b115b97ae7d0ae642daae2910d44ad9ec5a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\22b40106-9fd1-40a2-a5bc-1cd862714774.dmpFilesize
4.4MB
MD5fb08b5784e231db899bd1f2665c172dd
SHA1e1cc0e9fe83eb5c5cf4d46018533d29e79fc80a9
SHA2564829310b15a7613160c38e1999a8eed980d83ef20efb6359242c7536950d79d9
SHA5125c9e923d5b5b132a642b043673e59582d22527946d4a38a1ebd9389b00c91a70d7290f4f22ca711ce26039a49aaffa9a9088aeedac9e311cf248eb6b6e56c186
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5b80cf20d9e8cf6a579981bfaab1bdce2
SHA1171a886be3a882bd04206295ce7f1db5b8b7035e
SHA25610d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1
SHA5120233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.dbFilesize
1024KB
MD55eda3ebc416ca3525af666641649f91d
SHA1460d948613ed92a9f07969f80e79d9f8d6e43b73
SHA256bb762e35b9aa73cd3650619eafbd1f8841a6468c2d0ab0aff9663a27794dfa4f
SHA512820eed068ed96f7946ce53d59afdaa68629cb42c01ae6e88d3302cd5e87f58f91c174732ac8dfcebab2a6329b5f12ee1c97b028efeb12be088c64a809a325a21
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.dbFilesize
24B
MD5ae6fbded57f9f7d048b95468ddee47ca
SHA1c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA256d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
SHA512f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.dbFilesize
7KB
MD5eec410bdf8a3b1de8db53f132ff2bd2c
SHA1fba6925169f9f7a70eb7ee3c44a589c097a4d553
SHA2569fa140611881e7a2ec16a3fab4bef8a4cf917647f8f3580ee50a375d25e1edcb
SHA512ff3c36eb89bc94f68b48095adb1b1dc74074f7445d7b1c254992abcde4f4ba09e18d9f13cdfb6608bbc2872353f1714c312407f2e9d0fdb208019f45037fdc24
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.dbFilesize
7KB
MD5606207783b693ad54ada9bdcd741eb9e
SHA12e6a9bbfff3f1aa6a97cc02a8277e9baa7359f14
SHA256dffb760b057fb6da1c4b4eb0f4ad88c50c228a8561358d0d2636eb40b2eaaa61
SHA51211d6ae012e949faa5f33e442094e37644c97755eb14272c372877067d5d8727773df99c9563c9b9afc9426f5ee94afb508d37d59d3d447a4e5783454929bb523
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9V1S48VT\microsoft.windows[1].xmlFilesize
96B
MD51163e40619c903cdc6009b9302cc83a9
SHA16a0e708cd11a89debc6a7775f2b4485361bf9c41
SHA256e8568145d26054f8749fd050fc825c887c6603a2dc7677adcd8e41a5502cd4cd
SHA5123beb36bfeae5251252e0faf743af1c53ba6bae62ac51be0c9eb93c035f63c51acfa2fc32617851c551e31bc55fdaf50f2874d540fdfb2159b8d0295e80cdb208
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.datFilesize
1KB
MD587fd27714577ab7d5a0385f9307ccf68
SHA187f743ee5da01ab7e1e8b594bef6b2fe87cdaa90
SHA256f9bff15e8717ab9c31e4a06da267530c84bfb8155519db9b81d90a779fdcab72
SHA512bcf6c551373117641a1eba105098a57949a6f616cf8e455bad0fd23ec359afe5c2b0cd1911a15080209078fe45b4516b2bb655c0c8009b9a4dcf10cc2c9eaaaa
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.datFilesize
5KB
MD5be8c989e382a0711c37944c2c9ac5fc8
SHA1ff03503bd28cdc2083b2571281a2e8d3bdf9da88
SHA256dd8884d63b19fd5b994ac18dd158e754acfc9eed95589d51ce917abde9e635df
SHA512233f480fd0ea2ecd5b3c2214a4494d65747b97d2b400895db70518334dcf46af9724a9b6ad972121f0fa18b9c3c233ec5869c7d85221a7c5a0528cc6d8918a97
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Soft\TTL-128.exeFilesize
420KB
MD5ee5d07d552e76c57be11060fb6b175c8
SHA1ab26f26ba696020def1e99c0ceab242852ca5561
SHA2560afbd4aad79b603ed14c3a6892c815a8eb1ab83a0d21d27664c74d14eff5accd
SHA51289b638b378902c65ac9d900e24b05dbe2b5a5e116d342c7dedce2dfc1cc8e0f7626549c6824ca1aed02994f67f9cecd1c46fb9d4d4f6630fa2368acaa1c7ece9
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\TTL.apmFilesize
354KB
MD548fcdf2e9fb151694e971f29da9572b5
SHA1627a7b4bdfbf113490415d603ae9990281cbe61b
SHA2562738fad0a272dcc55e2d1a3875a7ac3ade0da2e7d7d6eba0ec769eb1b556d9f7
SHA512ce41f64f13b7235d467140abb1757b181905280580f51cd3b761b12928a889e7ff2958f87ffedb8fff6336dd1d3b07c360621220d0ab163ca891e0f4fbc7c705
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\TTL.exeFilesize
1.8MB
MD585e9948794eaa4d8063603c2a33d564b
SHA120632d9b9945fd97136c724e456fd60486918275
SHA256c0d6a7efc46ea71336ef3c5035c03b0127901d200205079b19ba4c3c2f24f029
SHA512a2bf9a6c7a7fbd7b7aa87bfa4a60b38bc6472095c208f6b052e71e7834116eb9d5b7d4eb4ba765c635ff90ee718276474ba62b2d3de8e40644eef2fce94799d1
-
C:\Users\Admin\AppData\Local\Temp\WindowsService.exeFilesize
227KB
MD5993412ff67717a2585c1ff8cc0035e3a
SHA1f215529cbefa6adb3636f2c0503695728da496cc
SHA2569b9a1e80fbba62a19279355263357e19985ae87022143a775a4a7c4423f1a018
SHA5125f016208159d412eb023a439fa8ae2df8095db6641f6a156fb9bcf065b1f10884df997b48ba2182adb00ba85e507fe9e2bb15cdcb7d7694896df699e2c4e9d3c
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_avh51voo.1wo.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\apmC2FD.tmpFilesize
148KB
MD510a2f663fdc511fd52bfcfd0a8837549
SHA1e3669af6eeb82c20b10245caa4974cb727b52bf0
SHA256bd5f2e4ac7c2bea616fa60a50698b0d6d46a9456c08392a5c62c340d6f738eeb
SHA5127e54bcce8f6813873db102f010431ad1ba83d554e9c368c598d428a1b8e6bc10f3622e559c0daa9d5b1740aa6fc08a5d97bc3f23217035b929a64b0399ce9830
-
C:\Users\Admin\AppData\Local\Temp\b0494a1f-4bd3-KX9rGV8JlgyIgeoji9hdGA==\System.Data.SQLite.dllFilesize
1.1MB
MD53746fc5aa700aec3db6739c1af6e546a
SHA13947be3965c6bb483588a636778dc8de16a2060e
SHA2562897a989df1eb7bfc7b1c154fcc8f8d872bce8854679e8bc318c33e4283137d7
SHA512be2521ccc96f54fddec070be539c78d8a82d9cb4e1676333961c56003353db9582a772049c6263be2b56a9769aeac75e2f46f4d6f484c87489a6e61ab9df231b
-
C:\Users\Admin\AppData\Local\Temp\chrome.exeFilesize
129KB
MD5f39b6bbb08140c8b9605a963ac3a1a91
SHA14526ee86eb22d2b9ff0032e9c3b79934fe471aba
SHA256bf99a65ec277081f265d0580c2960d460a9878182bc4920b6e37a11d32356b1a
SHA5123ba01f15d55a72ef5b6a54e1bf7de2552b5346deb6f958ef6b7456a27d98303f5cae8d043ef29d315147350423b9153b6258d2be4d022072d28f7136269ffb2c
-
C:\Users\Admin\AppData\Local\Temp\explorer.exeFilesize
66KB
MD53c703263450447c2b8acd6db4e5b0dee
SHA13d3dcfb917a75aee541295a8c967d0e5602098a7
SHA2565a6197a5416871d717d8341783a2fe48ef51196c36889ce9aed77d09a3bbcb49
SHA51291874c835abcd67e531f3d281019727a943bbd46c56df20c0f540391d4f0d2a831407d7712c1b27bd5a3cc11d44e760b655bee4405db36be230963445a61e474
-
C:\Users\Admin\AppData\Local\Temp\huter.exeFilesize
188KB
MD556f643ddde6c28f1e29eb840d59e0270
SHA17bfb2fdf12514e1a68ba4e63d6a649297cfa947e
SHA2564df1ccfe4b9468090bdfccceb8facf776bf565551b876afe506f7e2651cc4ff7
SHA51298a1b34d7493d3350256c4db98a0706648deda48e855e6228289773368c27e71511a22e7496870a20c2b38fddc22c7a3ec4c2aa78a97c8ff115bf070cca856ac
-
C:\Users\Admin\AppData\Local\Temp\lydip.exeFilesize
544KB
MD5c400461e908354e01adab15990194924
SHA1f6702f2cf86d066a0e921eeb73a6ec6e1a7d79e3
SHA256463dd29b2aa2387e779b46f9b4e85b1ca413902434770556c40975dfbad8b034
SHA512b027a36abb696bf23f27b739f7904f75514e01768a673b8efef3cc67740d508c3b844eea073084a58346c20f3d3bd3c32e38099d34c7ce67cfe931ebec6782fa
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
253KB
MD5dd4c7b8228023bb033e896214a7ca95b
SHA12bad833bf330ef557788ef88062e0e6085308404
SHA2565c0d4d84e872c0db72e2e794984be910479e96a8362df575902d73cc3d563f47
SHA512fdff879f0d6c3f640e081a7cc0e46bad0bfd4232a37638d2f031f21738ea5df579f4019712540d4cc8a0cdad1ba7b1523a8baeda1430edb83fe64d935eed793a
-
C:\Users\Admin\AppData\Local\Temp\wujek.exeFilesize
72KB
MD572039a5a653662ac7a0be93ef40c8bad
SHA1b9ad351a16588b6c14c0b3d4f5fabbae4e0e7287
SHA256c6bf0584203801e5793fccde5afe63bc3caae51a6344305236827201f6a0ac32
SHA512c5b885bd5fe18eb8d43f01766db6f6a1c6f328b6c9e3930488b9d2fe77e28a696ca7e812fdb73781cce4370e1eaded62372ae2c57451212e90f1f0cc40ab2a5c
-
C:\Users\Admin\AppData\Local\Temp\zbhnd.exeFilesize
51KB
MD548dc45f5672cac4632d344e59abf5bdb
SHA1071806e33769ae5b65b5e31eae2241eacf68ac27
SHA2566dbc598cab9a81cb7800b47bc4fd2e49262a02433f3f09bdbbcb59ba534b4682
SHA5122df1a3cb7bf8ed8f5ace6041c57138a62c9e011d19d44185a5646db1d3f9ca00235521418559d8d0713e70d26a6a69a3c9e71eb60308c1a4a02d9b2371704d39
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpgFilesize
14KB
MD52257fa8cef64a74c33655bd5f74ef5e5
SHA1b9f8baf96166f99cb1983563e632e6e69984ad5c
SHA256ead48b70e048de6ccca219a229ca90b49a9d1b9c14bf3a7c5eaad544294fcfd3
SHA5127792be9b935a46a923e97bb76b76957070e116dcc4cb6fcd8b883c2d6f142285ebc9fd26cdf29bd19c8bdff412487f586abaa1724332b613e71afa45d7f3e4f9
-
C:\Users\Admin\AppData\Roaming\Tor\Tor\geoipFilesize
2.6MB
MD599e9d290960ba936e6533a46598463ef
SHA16346e26e2bc96f8511588ce2695e9b0339a75d32
SHA256f12844bd73b3d7d19cb9c8a85a61e90769abe7778ea25e5a37b2a62a8c91b8df
SHA512788f4a91a903661b2eb56dc9a80cb8998082f43ba082757d4eb8ee113cb1584d4fbc864eb7aa29d8c6c436125ac72f01bb2a62fa0a27606d1d7c86e7eda7e492
-
C:\Users\Admin\AppData\Roaming\Tor\Tor\geoip6Filesize
1.4MB
MD51447e869f72e6e28ffc2eb9b1bff5ef5
SHA143ccb43dbc653d8cc16396a882c5f116a6004f0c
SHA256ebe6d2f4bc178ff4f9ddfcdf4e861b154f973aaf585b4bef29777592ed10943e
SHA512b641987abbc427a43a65d84d2c769c610706d8e9a2081a421be7dd7d3e5d83e58e027d2dfc210d3a233e104a9fdecbff0ff28ad919412ef14c18f20d9940c830
-
C:\Users\Admin\AppData\Roaming\rFggFdFgHJ\lnyvxwlkPbHf.exeFilesize
441KB
MD57446c57e64a1b038f4e03ba9368bfaa0
SHA1e3dccb305b23cddc26c17c8ce4bc94d4f91fa974
SHA2563057f39e4f208f2230aec594a24d232021d156b0b1fee804791b483e3fb09b63
SHA5127171f3d67bab7356fc94a744f4267788d4c10a851d70a38b175a884719c54934f7c74392773d2cbe61ab7a57978a020e00e77d8ecc4e9c2a8ef650d8418a440b
-
C:\Users\Admin\AppData\Roaming\tor.zipFilesize
4.3MB
MD5733aa0d9e18390a0a24e50c8e41a1476
SHA16d347ec2ca9090ddc9169b3f22f45ebbaecfbf3b
SHA256011f13d1ada76c6138c327f0d48a052662b0ae7c21a98e1dfea45ad3dafc5c41
SHA512eaa68b97b5b0c250338c9eb992df8fd17c521d06132b34dcd23677554331d6cec00a5fa3e3ee82297c613bd6686a30c952dce3a14892a4124a028e69c2870ee3
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.MSIL.Blocker.gen-097c62c749f1117c1770609807183f461c1073af5e4e0f385335373d90033461.exeFilesize
183KB
MD5def1fbb91521d33eb56e7441ca5242b9
SHA14a1a603945db4d76b68d66073c5090d1f9cf9e46
SHA256097c62c749f1117c1770609807183f461c1073af5e4e0f385335373d90033461
SHA5124c54028cb947d5925581322fa125a9c61a545b521990bbfb1a7713b8b3587d9dc50841dd514228401ecb190cbc34f539a74775a538413154de43ba2af617501a
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.MSIL.Encoder.gen-0a15523dea074c077b408cc2dfde2d769f0c90a9a70bfe1c311cd109769a414d.exeFilesize
802KB
MD555c9c1c2ac827165710e916324fc7d92
SHA18873b0414231579376f2b919dfbc22e995ee39a9
SHA2560a15523dea074c077b408cc2dfde2d769f0c90a9a70bfe1c311cd109769a414d
SHA5125b0d6953deefac6bdf05d7a518a22011743be753d8b1e3946bfca7133b5e9eda3a83cc9f07a71999b4fdbc90f6d0652197a47c2b0518603d5a8fa1fd185d0991
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.Blocker.pef-16107ff165ea1583453c4601382e8ffa94c165eed719528ba39b9e1517d91522.exeFilesize
50KB
MD5bc9ee38edef46b1b0b36d4d2310aeb21
SHA1d4880d2e0e143ed16f45901e6ea336b6f63d0ff2
SHA25616107ff165ea1583453c4601382e8ffa94c165eed719528ba39b9e1517d91522
SHA5120bd5c2b3a2e7438bf6aee408a0f93ccba337b14ee39f77481e8fa172c8f0bb7ca25b278ca0be70253ed6476be96a669a9cdb97e63464538df3559e66694fc3e4
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-21d02500d4112571a166bba52766140de90b58792e7b1a19741fe3e4c819ffaa.exeFilesize
1.8MB
MD5b3551805332c01582ead9ec9b9dbc11c
SHA17820208953290391f16cf0533bbea1557df677f5
SHA25621d02500d4112571a166bba52766140de90b58792e7b1a19741fe3e4c819ffaa
SHA5128ad5c95eb5c35c6940bd1a82f8be8dec016ad0e9faa00b3193cb97f72a44acd7bf0deaa941462ca4e66047e2b526c63d93169295fbdb7bf9a6a2cb9a101c0bd3
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.Cryptoff.vho-3c125e17c7fcedbe58f24645457f392d82354e9be0986d99ee9654c8c9b4e28a.exeFilesize
130KB
MD572853df4907086f26a193ab9a0781940
SHA10e4099d91f048870e7453a826052729ff4425b58
SHA2563c125e17c7fcedbe58f24645457f392d82354e9be0986d99ee9654c8c9b4e28a
SHA512ace997fd2eb5b0507301a034187c760a8febb89954ff511c685f749865d3cd97ca3c0e1dfd7fd985ba7cd0bb8312e922d44d87b55c448e784cfbb90403b0a7db
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.Gen.gen-92e00259ce381ad31f02a0a8c14d617abb27befa8875c19e4a380b7b580ff825.exeFilesize
199KB
MD56b2ef432e8cdf372d22229682ea3abab
SHA1cec6ba82daad7bb04b1976ec09a6faa3128a8590
SHA25692e00259ce381ad31f02a0a8c14d617abb27befa8875c19e4a380b7b580ff825
SHA5127be8fb19a170791d758a66b1b8650aa1ab5590df62d804d708f908a59f74eea9684d5225f62539d88368ab8e67d8f584879f22a582587d8c8f6802c4c6d2329a
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.Generic-f4294944ad82c2c9e0cf9cfb31461bfaa97741fd35d4eb11068fad722e93d8cc.exeFilesize
2.2MB
MD5be2636f8afcb810bc8dec59191f15265
SHA1d9dac409acf01562e5369cd0f80b5e0af6f79270
SHA256f4294944ad82c2c9e0cf9cfb31461bfaa97741fd35d4eb11068fad722e93d8cc
SHA512dbbf84d50602cfe75b3b895a25ccbbdab07292d7334b1cec1ec21275ae87a49a3485ba4482a5877b11bf8ba1a6508612c05f03eed685447f0d4d3cc8be15a71d
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.Phobos.vho-a4c7517fe4548f71f2f2e6848100d638c3bd7d03fa225ca598a03824b7575fd1.exeFilesize
55KB
MD53ada72cac8ab9b5578ae56fce08aac52
SHA1175d036720d40787c9d3614623f2f88381396a71
SHA256a4c7517fe4548f71f2f2e6848100d638c3bd7d03fa225ca598a03824b7575fd1
SHA5126551387585f3e7904e6a062123edb7b628bb7996ccb6c129c275728ec9ff76bce1287abe4b6f49d89d4f640f75251af0b7ca443cface087bb34f96203cd6e955
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-288506a5e91bce7b6d67f164ceca2043981e2c0ffb57b1c9f43080df87ba54ea.exeFilesize
17.2MB
MD5297e13c8ac4f7a51fac399fe8aaa3baa
SHA1a96170a3eb0e21690b6fd05a204225c2114b6dff
SHA256288506a5e91bce7b6d67f164ceca2043981e2c0ffb57b1c9f43080df87ba54ea
SHA5121ac135a215805e1a8d51971ea8f8a1c1b3688f1b85ba4b8e4fb7439486d1bb78325f1755285055c8be67272d8e615f556ef03a9b944de0cb6b056425dbd261ff
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-0cf2980957b6cac5bcd07053ddfc75774d142d64742e079e15cbe31fbf0c73db.exeFilesize
161KB
MD561e56b0c0f75fd432b2d1b58c24a732b
SHA19f930a2d1df2eb263215699d68a7626967711a6b
SHA2560cf2980957b6cac5bcd07053ddfc75774d142d64742e079e15cbe31fbf0c73db
SHA51250cb63860f8e4646438bbcadab7a261d5541b955cd8f2a58acd2ce20e3188d311cf6ca135489a75bab32882ca4cbff2183e5c079f7bf14f2c6a99a6d40d0ddb1
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-1b11e0d978a65022cff640180ab755b1ead1446bc159b3423a71447c8d82b8e7.exeFilesize
473KB
MD5dea5481adbaa03bed3e3e03fa84b51fd
SHA1f491cef80ebb2f75f7dab9ba1d86bcef68e498c6
SHA2561b11e0d978a65022cff640180ab755b1ead1446bc159b3423a71447c8d82b8e7
SHA5123a32ea84f2a29471dbc5449ec84480349f60df65f211e7f25205d3094857e0cd60536dca00b746b59eb096106c2ffc16d339f0bc0c25143e3f883c700a566d9e
-
C:\Users\Admin\Desktop\00472\HEUR-Trojan.MSIL.Crypt.gen-2a2a395a08cc6f189d1183d626573791f7d430ac832f4360bf7c69d0b1a4fd87.exeFilesize
15.5MB
MD55849b50d06bcc517b666b5f46100b518
SHA1126f85c749dcb485b9d82041a0aad14361650cfa
SHA2562a2a395a08cc6f189d1183d626573791f7d430ac832f4360bf7c69d0b1a4fd87
SHA512bf64f3bdb81795964e2baa227069ab436be5cb31c6b7c5de6a8c1d37bdac7a6a8d6fd537ca663d40a11bfc90d8495ac6d00a9a7f9e1137e4bb2467eeceb9cbc2
-
C:\Users\Admin\Desktop\00472\MetroFramework.dllFilesize
149KB
MD544538b311e9ec2bcf0a6452702628d99
SHA1da67301539903775708e9ec913654851e9e8eade
SHA256baf326f52d39155d722465947f4cc67e6e90cfd0f89954eab959568e9bc342aa
SHA512b65e3bc1c0f7b4c8f778cf52a36d628301d60aab53fdaf0355163e4865bc3d3adbf8870bb6cefc604708fdf2c0e72258eaf2fe301d524af2f77bc08014c9610a
-
C:\Users\Admin\Desktop\00472\jhsaebey.batFilesize
43B
MD555310bb774fff38cca265dbc70ad6705
SHA1cb8d76e9fd38a0b253056e5f204dab5441fe932b
SHA2561fbdb97893d09d59575c3ef95df3c929fe6b6ddf1b273283e4efadf94cdc802d
SHA51240e5a5e8454ca3eaac36d732550e2c5d869a235e3bbc4d31c4afa038fe4e06f782fa0885e876ad8119be766477fdcc12c1d5d04d53cf6b324e366b5351fc7cd4
-
C:\Users\Public\how_to_back_files.htmlFilesize
4KB
MD53126eae4c5eac7c83469d4129d79f937
SHA1023444ed119338c56b900f496d38e4c4cf6a7045
SHA256850dc816e2dff1082b98fe8882c1076b7ba747c3c7d2598cbe561600e2dc7a9b
SHA5121a6fedb8be932ff392ae32f012644455e22202184ac093218e77fd90d5d2d4f9e1073c6f825c75307fff110b8050f20079c6e41b4067745ae261accd6bf00572
-
C:\info.htaFilesize
5KB
MD5e2b57487a2ca627482d62d835fe7f19a
SHA1cc6d492b2731ccf9610e2b294ebf3a55ee62efa9
SHA256c3628feed781e288fa8674061a5390c31dd238206b8f32bd6a64ac8543a257e5
SHA512a40bcec9cf2305011774009ab35a24cb4764ec929ac04669ef446a1ea558c78bc4108a30e9048f1a2290a90e36e6965c5854959cca6728da429a3a932f3bd23c
-
F:\$RECYCLE.BIN\S-1-5-21-2629364133-3182087385-364449604-1000\desktop.iniFilesize
129B
MD5a526b9e7c716b3489d8cc062fbce4005
SHA12df502a944ff721241be20a9e449d2acd07e0312
SHA256e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
SHA512d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
-
F:\$RECYCLE.BIN\S-1-5-21-2629364133-3182087385-364449604-1000\desktop.ini.id[54A67FCC-2930].[[email protected]].ekingFilesize
386B
MD5788a903eaf779da3210847782f9521dc
SHA103ff9affbbcbaed033164ebfc0cf62541fee1f92
SHA256c33dc0ba45d29aa8201b6eaf7e66b339bf5821ab8bea9d428bee644410860fad
SHA512a33b5e92c097808d99d5d5a6d3540419cd47f8f040b36f87e3d35140c70ae285499b2643d072f99c0e0e11ace72b3c8f6ecfd122dfb2db23651a564bda7dfe4f
-
F:\AUTORUN.INFFilesize
145B
MD5ca13857b2fd3895a39f09d9dde3cca97
SHA18b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA51255e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
-
\??\c:\users\admin\desktop\00472\heur-trojan-ransom.win32.encoder.gen-fd9bf3cdb00dc14a3d673942136237ea533cd6146db7efd334e667bc6206e8c7.exeFilesize
1.4MB
MD58294a7fe5e5b0c725d8d5cefe05258aa
SHA1481b0d4285a33e0ae44fbc1fe75c51304a4965e8
SHA256fd9bf3cdb00dc14a3d673942136237ea533cd6146db7efd334e667bc6206e8c7
SHA512c3b84bb0a444be5189b294ac44404658a6e6bc347e8f28103499307033d66371b1528408b20c7bdbf2ec410e94cbb625f34744409979b81bdced5cfe5fdde122
-
\??\c:\users\admin\desktop\00472\heur-trojan-ransom.win32.gandcrypt.gen-5aff02b30f771b46c66d3b7d6ff42aff48a6584c0d0a012856758d1eb6cfeb09.exeFilesize
181KB
MD59b2b388ccff72cc58f8dc320842c5bba
SHA108e909c703247714fdf8f8fad5275a79d4d2afad
SHA2565aff02b30f771b46c66d3b7d6ff42aff48a6584c0d0a012856758d1eb6cfeb09
SHA512729f8e9e2fcc001dc1cbc9eedef3b82fcb95f88bcc86e6e11e4adbbb872ba200c3256dc81857b0043434be9c86b5eb7d2d4251272f725fb30b36326ae016229e
-
memory/292-2719-0x0000000000400000-0x0000000001A72600-memory.dmpFilesize
22.4MB
-
memory/292-5580-0x0000000000400000-0x0000000001A72600-memory.dmpFilesize
22.4MB
-
memory/448-140-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/448-207-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/652-269-0x0000000000AB0000-0x0000000000B08000-memory.dmpFilesize
352KB
-
memory/652-277-0x0000000002C70000-0x0000000002C7A000-memory.dmpFilesize
40KB
-
memory/976-41174-0x0000000000F70000-0x0000000000FA1000-memory.dmpFilesize
196KB
-
memory/976-10744-0x0000000000F70000-0x0000000000FA1000-memory.dmpFilesize
196KB
-
memory/976-41009-0x0000000000F70000-0x0000000000FA1000-memory.dmpFilesize
196KB
-
memory/1100-2450-0x0000000000400000-0x0000000000807000-memory.dmpFilesize
4.0MB
-
memory/1100-5438-0x0000000000400000-0x0000000000807000-memory.dmpFilesize
4.0MB
-
memory/1100-6143-0x0000000000400000-0x0000000000807000-memory.dmpFilesize
4.0MB
-
memory/1100-3102-0x0000000000400000-0x0000000000807000-memory.dmpFilesize
4.0MB
-
memory/1100-1065-0x0000000000400000-0x0000000000807000-memory.dmpFilesize
4.0MB
-
memory/1100-642-0x0000000000400000-0x0000000000807000-memory.dmpFilesize
4.0MB
-
memory/1100-446-0x0000000000400000-0x0000000000807000-memory.dmpFilesize
4.0MB
-
memory/1100-168-0x0000000000400000-0x0000000000807000-memory.dmpFilesize
4.0MB
-
memory/1100-442-0x0000000000400000-0x0000000000807000-memory.dmpFilesize
4.0MB
-
memory/1492-620-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1644-1609-0x00000000126E0000-0x0000000012A34000-memory.dmpFilesize
3.3MB
-
memory/1644-606-0x0000000006370000-0x00000000063D6000-memory.dmpFilesize
408KB
-
memory/1644-1679-0x0000000012A40000-0x0000000012AF0000-memory.dmpFilesize
704KB
-
memory/1644-1680-0x00000000112F0000-0x0000000011372000-memory.dmpFilesize
520KB
-
memory/1644-701-0x000000000FC00000-0x000000000FDC2000-memory.dmpFilesize
1.8MB
-
memory/1644-1735-0x0000000012B60000-0x0000000012C77000-memory.dmpFilesize
1.1MB
-
memory/1644-1726-0x0000000012A40000-0x0000000012B57000-memory.dmpFilesize
1.1MB
-
memory/1644-604-0x000000000F180000-0x000000000F62A000-memory.dmpFilesize
4.7MB
-
memory/1644-602-0x0000000009B00000-0x000000000BDE8000-memory.dmpFilesize
34.9MB
-
memory/1644-323-0x0000000000450000-0x00000000013E2000-memory.dmpFilesize
15.6MB
-
memory/1840-2756-0x00000000053A0000-0x00000000053AC000-memory.dmpFilesize
48KB
-
memory/1840-2485-0x0000000000720000-0x0000000000742000-memory.dmpFilesize
136KB
-
memory/2000-8358-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2036-100-0x000002097D370000-0x000002097D3B4000-memory.dmpFilesize
272KB
-
memory/2036-101-0x000002097D440000-0x000002097D4B6000-memory.dmpFilesize
472KB
-
memory/2036-90-0x000002097C5D0000-0x000002097C5F2000-memory.dmpFilesize
136KB
-
memory/2696-631-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/2696-261-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/2780-2452-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/2780-482-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/2780-3502-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/2780-5581-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/2780-242-0x0000000010000000-0x0000000010081000-memory.dmpFilesize
516KB
-
memory/2780-1461-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/2948-114-0x0000025CF4E60000-0x0000025CF4E61000-memory.dmpFilesize
4KB
-
memory/2948-109-0x0000025CF4E60000-0x0000025CF4E61000-memory.dmpFilesize
4KB
-
memory/2948-104-0x0000025CF4E60000-0x0000025CF4E61000-memory.dmpFilesize
4KB
-
memory/2948-103-0x0000025CF4E60000-0x0000025CF4E61000-memory.dmpFilesize
4KB
-
memory/2948-102-0x0000025CF4E60000-0x0000025CF4E61000-memory.dmpFilesize
4KB
-
memory/2948-110-0x0000025CF4E60000-0x0000025CF4E61000-memory.dmpFilesize
4KB
-
memory/2948-113-0x0000025CF4E60000-0x0000025CF4E61000-memory.dmpFilesize
4KB
-
memory/2948-108-0x0000025CF4E60000-0x0000025CF4E61000-memory.dmpFilesize
4KB
-
memory/2948-111-0x0000025CF4E60000-0x0000025CF4E61000-memory.dmpFilesize
4KB
-
memory/2948-112-0x0000025CF4E60000-0x0000025CF4E61000-memory.dmpFilesize
4KB
-
memory/3572-4573-0x000000000AC30000-0x000000000B206000-memory.dmpFilesize
5.8MB
-
memory/3572-479-0x0000000008ED0000-0x0000000008F7A000-memory.dmpFilesize
680KB
-
memory/3572-173-0x0000000005350000-0x00000000053C6000-memory.dmpFilesize
472KB
-
memory/3572-2587-0x0000000009CD0000-0x0000000009D52000-memory.dmpFilesize
520KB
-
memory/3572-2583-0x0000000009C30000-0x0000000009C3C000-memory.dmpFilesize
48KB
-
memory/3572-200-0x00000000057B0000-0x00000000057CE000-memory.dmpFilesize
120KB
-
memory/3572-163-0x00000000057E0000-0x0000000005D84000-memory.dmpFilesize
5.6MB
-
memory/3572-4571-0x0000000009260000-0x0000000009282000-memory.dmpFilesize
136KB
-
memory/3572-343-0x0000000006910000-0x000000000693C000-memory.dmpFilesize
176KB
-
memory/3572-154-0x0000000000860000-0x000000000092E000-memory.dmpFilesize
824KB
-
memory/3572-5514-0x000000000F4F0000-0x00000000137C6000-memory.dmpFilesize
66.8MB
-
memory/3788-2821-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3920-172-0x0000000004E90000-0x0000000004EE6000-memory.dmpFilesize
344KB
-
memory/3920-159-0x0000000000130000-0x0000000000164000-memory.dmpFilesize
208KB
-
memory/3920-164-0x0000000004C50000-0x0000000004CE2000-memory.dmpFilesize
584KB
-
memory/3920-178-0x00000000058C0000-0x0000000005A66000-memory.dmpFilesize
1.6MB
-
memory/3920-171-0x0000000004C00000-0x0000000004C0A000-memory.dmpFilesize
40KB
-
memory/3920-160-0x0000000004B00000-0x0000000004B9C000-memory.dmpFilesize
624KB
-
memory/4368-8698-0x00000000000E0000-0x0000000000111000-memory.dmpFilesize
196KB
-
memory/4368-39698-0x00000000000E0000-0x0000000000111000-memory.dmpFilesize
196KB
-
memory/4368-39296-0x00000000000E0000-0x0000000000111000-memory.dmpFilesize
196KB
-
memory/4520-453-0x0000000006570000-0x00000000065BC000-memory.dmpFilesize
304KB
-
memory/4520-376-0x0000000006260000-0x000000000636A000-memory.dmpFilesize
1.0MB
-
memory/4520-375-0x0000000005B10000-0x0000000005B22000-memory.dmpFilesize
72KB
-
memory/4520-292-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/4520-374-0x0000000006770000-0x0000000006D88000-memory.dmpFilesize
6.1MB
-
memory/4520-445-0x00000000063B0000-0x00000000063EC000-memory.dmpFilesize
240KB
-
memory/4604-480-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4604-209-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4640-314-0x0000000002DB0000-0x0000000002DB8000-memory.dmpFilesize
32KB
-
memory/4640-270-0x0000000000C10000-0x0000000000C3E000-memory.dmpFilesize
184KB
-
memory/4764-1736-0x000000001ED50000-0x000000001F21E000-memory.dmpFilesize
4.8MB
-
memory/4764-1747-0x000000001BCF0000-0x000000001BD8C000-memory.dmpFilesize
624KB
-
memory/4764-1678-0x000000001BA60000-0x000000001BB06000-memory.dmpFilesize
664KB
-
memory/4784-189-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4784-190-0x0000000002220000-0x0000000002237000-memory.dmpFilesize
92KB
-
memory/4784-441-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/5108-370-0x0000000000400000-0x00000000005BB000-memory.dmpFilesize
1.7MB
-
memory/5108-477-0x0000000000400000-0x00000000005BB000-memory.dmpFilesize
1.7MB
-
memory/5108-146-0x0000000000400000-0x00000000005BB000-memory.dmpFilesize
1.7MB
-
memory/5204-6293-0x000000001B340000-0x000000001B348000-memory.dmpFilesize
32KB
-
memory/5448-2013-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/5856-2106-0x000001AC34120000-0x000001AC34126000-memory.dmpFilesize
24KB
-
memory/6024-1193-0x0000000000810000-0x0000000000858000-memory.dmpFilesize
288KB
-
memory/6024-3911-0x0000000006260000-0x000000000632E000-memory.dmpFilesize
824KB
-
memory/6032-5731-0x000000006E520000-0x000000006E5A3000-memory.dmpFilesize
524KB
-
memory/6032-5732-0x0000000069B90000-0x0000000069D7F000-memory.dmpFilesize
1.9MB
-
memory/6032-5734-0x0000000000630000-0x0000000000888000-memory.dmpFilesize
2.3MB
-
memory/6032-5733-0x000000006E4F0000-0x000000006E512000-memory.dmpFilesize
136KB
-
memory/6352-2601-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/6420-3895-0x00000000005B0000-0x0000000000DC0000-memory.dmpFilesize
8.1MB
-
memory/6420-5557-0x00000000005B0000-0x0000000000DC0000-memory.dmpFilesize
8.1MB
-
memory/6496-8728-0x0000000000400000-0x000000000087C000-memory.dmpFilesize
4.5MB
-
memory/6496-8357-0x0000000000400000-0x000000000087C000-memory.dmpFilesize
4.5MB
-
memory/6712-7943-0x0000000000400000-0x0000000000487000-memory.dmpFilesize
540KB
-
memory/6712-8731-0x0000000000400000-0x0000000000487000-memory.dmpFilesize
540KB
-
memory/7136-3893-0x0000000000E80000-0x0000000000E8A000-memory.dmpFilesize
40KB
-
memory/7180-8356-0x0000000000520000-0x0000000000551000-memory.dmpFilesize
196KB
-
memory/7180-9162-0x0000000000520000-0x0000000000551000-memory.dmpFilesize
196KB
-
memory/7456-11052-0x00000000000E0000-0x0000000000111000-memory.dmpFilesize
196KB
-
memory/7456-8850-0x00000000000E0000-0x0000000000111000-memory.dmpFilesize
196KB
-
memory/7804-5573-0x0000000000AA0000-0x0000000000AAA000-memory.dmpFilesize
40KB
-
memory/7888-6202-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/7980-8697-0x00000000000E0000-0x0000000000111000-memory.dmpFilesize
196KB
-
memory/7980-9372-0x00000000000E0000-0x0000000000111000-memory.dmpFilesize
196KB
